feat: add dependency-cooldown - #45
Conversation
n13
left a comment
There was a problem hiding this comment.
Reviewer model: GPT Sol
Verdict: REQUEST_CHANGES — the scheduled audit cannot complete on this repository, and the pull-request check is not configured as a required merge gate.
Findings:
-
High — Require the cooldown status on
main..github/workflows/dependency-cooldown.yml:13createsdependency-cooldown / Dependency cooldown, but the effective rules formaincontain only deletion, non-fast-forward, and one-approval pull-request rules; neither the ruleset nor branch protection has a required-status-check rule. A dependency PR can therefore still be merged when this security check fails. Add the cooldown job as a required status check in the activemainruleset before treating the gate as enforced. -
High — Fix the scheduled audit's handling of the existing local tarball.
.github/workflows/dependency-cooldown-audit.yml:12invokes the currentshared-workflows@v1audit over all locked versions. On this exact head,bun.lock:1522recordshuman-readable-checksum@./package/human-readable-checksum-0.3.0.tgz; the Bun parser does not recognize the relative tarball specifier as non-registry, querieshttps://registry.npmjs.org/human-readable-checksum, receives HTTP 404, and exits 2. As a result, every weekly or manual audit will fail before producing the intended age report. Fix and publish the shared parser so relative/local archive specs are reported as uncheckable, or omit this audit caller until that fix is available.
Validation:
- Reviewed the full diff from
c66e017422ad7f395c84a0935fb4e90c567e66f7to116f08befddf92df6347d6d87df833c6a3858889;git diff --checkpassed. actionlintpassed for both new workflow files.- The live
Build and Testand pull-request cooldown jobs pass; the shared action's check mode also passed locally with zero introduced versions. - The shared action's audit mode scanned 1,500 locked versions and reproduced the npm 404/exit-2 failure above.
We will fix this later to enforce it in the repo rule set because I don't have permission. |
Have fixed it in the shared workflows repo. |
n13
left a comment
There was a problem hiding this comment.
Reviewer model: GPT Sol
Verdict: REQUEST_CHANGES — the shared audit failure is fixed, but the cooldown check is still not enforced as a merge requirement.
Finding:
- High — Require the cooldown status on
main..github/workflows/dependency-cooldown.yml:13createsdependency-cooldown / Dependency cooldown, but the live activeprotect-mainruleset and branch protection still contain no required status check. A pull request that introduces a dependency inside the cooldown window can therefore show a failing check and still be merged, so the intended gate fails open. Add this exact status as a required check in the activemainruleset before merging; this may need to be done by a repository or organization administrator.
Validation:
- Reviewed the complete diff from
c66e017422ad7f395c84a0935fb4e90c567e66f7to116f08befddf92df6347d6d87df833c6a3858889;git diff --checkpassed. actionlintv1.7.7 passed for both new workflow files.- Re-ran the current
shared-workflows@v1bundle (32aabd71d49df3482e4721eeb3f3d6fb5918850f): check mode passed with zero introduced versions, and audit mode successfully checked 1,499 locked versions. This confirms the earlier local-tarball/404 blocker is resolved. - The live
Build and Testand pull-request cooldown jobs pass. The repository ruleset and branch-protection APIs confirm that no required-status-check rule exists.
n13
left a comment
There was a problem hiding this comment.
AI review nagging, will be fixed on main
Summary
Added workflow that check direct and transitive dependencies age