2GT-Rich
4ef9fd0e37
The Security Audit job failed because new advisories dropped against existing deps and `npm audit --audit-level=high` audits the whole tree (incl. dev/build tooling that isn't shipped). - Switch both audit steps to `audit-ci --high --skip-dev`, so the gate reflects what's actually deployed (backend ships --omit=dev; frontend ships a static build) while still failing on real high/critical production advisories. - Allowlist GHSA-qwww-vcr4-c8h2 (React Router "RSC Mode CSRF") for the frontend: this is a client-side SPA using BrowserRouter — RSC mode is not used — and there is no forward-compatible fix for react-router-dom 7.x (only a downgrade). - `npm audit fix` on both lockfiles to patch non-breaking transitive dev advisories (js-yaml, postcss, brace-expansion, minimatch). No direct/prod dependency versions changed; app runtime is unchanged. Verified: backend 114 tests pass, frontend builds, and audit-ci passes for both projects locally.
96 lines
2.3 KiB
YAML
96 lines
2.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
frontend:
|
|
name: Frontend — Lint, Type-check & Build
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Type-check
|
|
run: npx tsc --noEmit
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
backend:
|
|
name: Backend — Lint, Type-check & Build
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: backend
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: backend/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Type-check
|
|
run: npx tsc --noEmit
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
audit:
|
|
name: Security Audit
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: '20'
|
|
|
|
# Audit production dependencies only (dev/build tooling isn't in the shipped
|
|
# image: the backend installs with --omit=dev and the frontend ships a static
|
|
# build). audit-ci lets us fail on high+ prod advisories while allowlisting
|
|
# ones that don't apply.
|
|
#
|
|
# Allowlisted:
|
|
# GHSA-qwww-vcr4-c8h2 — React Router "RSC Mode CSRF Bypass". This is a
|
|
# client-side SPA (BrowserRouter); we don't use RSC mode, and there is no
|
|
# forward-compatible fix for react-router-dom 7.x (only a downgrade).
|
|
- name: Audit frontend dependencies
|
|
run: npx --yes audit-ci@^7 --high --skip-dev --allowlist GHSA-qwww-vcr4-c8h2
|
|
working-directory: frontend
|
|
|
|
- name: Audit backend dependencies
|
|
run: npx --yes audit-ci@^7 --high --skip-dev
|
|
working-directory: backend
|