chore(x-gateway): 0.7.1 — version label for the claims TTL fix (#3293) #1063
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CVE Audit Gate | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Daily at 03:47 UTC (stagger from other crons) | |
| - cron: '47 3 * * *' | |
| workflow_dispatch: | |
| concurrency: | |
| group: cve-audit-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ─────────────────────────────────────────────────────────── | |
| # Job 1: Root workspace — BLOCKING on critical | |
| # Phase 1 target: 0 criticals (ADR-165) | |
| # ─────────────────────────────────────────────────────────── | |
| audit-root: | |
| name: Audit root (critical-blocking) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install root dependencies (lockfile only) | |
| run: npm install --package-lock-only --ignore-scripts | |
| - name: npm audit — critical gate (must be 0) | |
| run: npm audit --audit-level=critical | |
| # Exit 1 if any critical advisory is found. | |
| # High/moderate/low are reported but do not block. | |
| - name: npm audit — high summary (warn only) | |
| run: | | |
| # Use jq (preinstalled on ubuntu-latest) instead of embedded python | |
| # so the static YAML guard doesn't mistake an `if x > 0:` for a | |
| # YAML block-mapping key indicator. | |
| summary=$(npm audit --json 2>/dev/null | jq -r '.metadata.vulnerabilities | "critical:\(.critical) high:\(.high) moderate:\(.moderate) total:\(.total)"' || echo "audit-failed") | |
| echo "::notice::Root audit summary — $summary" | |
| high=$(npm audit --json 2>/dev/null | jq -r '.metadata.vulnerabilities.high // 0' || echo 0) | |
| if [ "$high" -gt 0 ]; then | |
| echo "::warning::Root workspace has $high high-severity advisories (non-blocking — target Phase 5)" | |
| fi | |
| # Non-blocking: highs are surfaced as warnings in the Actions log | |
| # ─────────────────────────────────────────────────────────── | |
| # Job 2: v3 workspace — BLOCKING on critical | |
| # Phase 1 target: 0 criticals (ADR-165) | |
| # ─────────────────────────────────────────────────────────── | |
| audit-v3: | |
| name: Audit v3 (critical-blocking) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| # v3 uses pnpm for runtime but npm for audit; no npm cache for v3 | |
| cache: 'npm' | |
| - name: npm audit v3 — critical gate (must be 0) | |
| working-directory: v3 | |
| run: npm audit --audit-level=critical | |
| # Reads v3/package-lock.json generated by npm. | |
| # v3/pnpm-lock.yaml is used by pnpm at runtime; this job validates the | |
| # npm-readable lockfile kept in sync by the remediation workflow. | |
| - name: npm audit v3 — high summary (warn only) | |
| working-directory: v3 | |
| run: | | |
| # jq, not python — avoids static YAML guard tripping on `if x > 0:` | |
| summary=$(npm audit --json 2>/dev/null | jq -r '.metadata.vulnerabilities | "critical:\(.critical) high:\(.high) moderate:\(.moderate) total:\(.total)"' || echo "audit-failed") | |
| echo "::notice::v3 audit summary — $summary" | |
| high=$(npm audit --json 2>/dev/null | jq -r '.metadata.vulnerabilities.high // 0' || echo 0) | |
| if [ "$high" -gt 0 ]; then | |
| echo "::warning::v3 workspace has $high high-severity advisories (non-blocking — target Phase 5)" | |
| fi | |
| # ─────────────────────────────────────────────────────────── | |
| # Job 3: Combined high-severity report (warn only, never blocks) | |
| # ─────────────────────────────────────────────────────────── | |
| audit-high-report: | |
| name: High-severity report (warn only) | |
| runs-on: ubuntu-latest | |
| needs: [audit-root, audit-v3] | |
| if: always() | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Combined high/moderate summary | |
| run: | | |
| # jq instead of inline python so the static YAML guard doesn't | |
| # trip on `if x > 0:`-style colons. | |
| echo "=== Root workspace ===" | |
| npm audit --json 2>/dev/null | jq -r '.metadata.vulnerabilities | " critical:\(.critical) high:\(.high) moderate:\(.moderate) total:\(.total)"' || true | |
| echo "" | |
| echo "=== v3 workspace ===" | |
| (cd v3 && npm audit --json 2>/dev/null | jq -r '.metadata.vulnerabilities | " critical:\(.critical) high:\(.high) moderate:\(.moderate) total:\(.total)"') || true | |
| # This job always runs and surfaces a combined summary. | |
| # It never sets exit code > 0 so it cannot block merges. |