chore: INFRA-312 record audit-gate triage note (outage was transient, no fix needed) - #223
Merged
Merged
Conversation
… no fix needed) The Security + compliance gate failed repo-wide for roughly an hour with zero repo changes, blocking every PR including INFRA-306's otherwise-green #221. It then RECOVERED ON ITS OWN: an untouched `development` worktree went from failing to "Passed npm security audit" with no edit of any kind, same node_modules, same lockfile. So there is nothing to fix in this repo, and this commit deliberately changes no CI config and no allowlist entry. It adds only a triage note, because the thing that actually cost the time was a useless error message. What happened: npm's legacy /-/npm/v1/security/audits/quick endpoint answered `400 Bad Request - Invalid package tree` for this ~1,185-package tree while auditing a 20-package control tree fine, and the newer security/advisories/bulk endpoint returned an undecompressed gzip body. audit-ci surfaced all of it as the bare, unactionable `code undefined:`. Eight hypotheses were tested and disproved (full ledger on the INFRA-312 Notion item). The one never tried was "wait longer" — a `gh run rerun --failed` about 30 minutes in still failed, which made the outage look permanent. The note therefore records the retry window explicitly, plus the two most attractive red herrings: npm's own "rebuild your package-lock.json" hint (the lockfile was byte-identical and structurally clean — 0 missing versions, 0 link:true, 0 non-numeric versions), and pinning a newer npm to reach the bulk endpoint (attempted in the since-closed PR #222; npm 11.18.0 was confirmed active in CI and failed identically). Verified the gate is healthy rather than merely quiet — a gate that passes because it stopped auditing is the failure class MAINT-307 and INFRA-306 both had to clean up. Dropping GHSA-mh99-v99m-4gvg from a scratch copy of the allowlist makes audit-ci exit 1 and print the advisory with its full dependency paths. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…2-fix-npm-audit-ci-gate
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes INFRA-312. No CI config change. No allowlist change. One appended comment.
The outage fixed itself
Security + compliancefailed repo-wide for ~an hour with zero repo changes, blocking every PR including INFRA-306's otherwise-green #221. Then it recovered on its own: an untoucheddevelopmentworktree went from failing toPassed npm security auditwith no edit of any kind — samenode_modules, same lockfile, same commit.So there was never anything wrong in this repo, and this PR deliberately changes no behaviour. What actually cost the time was an unactionable error message, so that is what gets fixed.
What happened
npm's legacy
/-/npm/v1/security/audits/quickendpoint answered400 Bad Request — Invalid package treefor this ~1,185-package tree while auditing a 20-package control tree fine; the newersecurity/advisories/bulkendpoint returned an undecompressed gzip body.audit-cisurfaced all of it as the bare, unactionable:Eight hypotheses tested and disproved
Full ledger on the Notion item. The one never tried was "wait longer" — a
gh run rerun --failedabout 30 minutes in still failed, which made the outage look permanent. Hence the note records the retry window explicitly, plus the two most attractive red herrings:npm installand structurally clean (0 missing versions, 0link:true, 0 non-numeric versions).The gate is healthy, not merely quiet
Verified rather than assumed — a gate that passes because it silently stopped auditing is exactly the failure class MAINT-307 and INFRA-306 both had to clean up. Dropping
GHSA-mh99-v99m-4gvgfrom a scratch copy of the allowlist makesaudit-ciexit 1 and print the advisory with full dependency paths:With the real allowlist restored:
Passed npm security audit.🤖 Generated with Claude Code