Repository navigation
fix: resolve CI failures — duplicate helm plugin dir and npm audit high vulns - #799
Merged
Merged
Conversation
…e exists helmfile init installs helm-diff under a directory named after the repo (helm-diff/), while a Helm v4 .tgz asset extracts under the plugin name (diff/). Both directories declare name "diff", so helm exits 0 on install but later fails at 'helm plugin list' with "two plugins claim the name diff" — breaking test-action-auto-init on macOS. The previous dedupe guessed the created directory from the asset file name, which never matched (helm names it after the archive's root folder), so the collision went undetected. Detect created directories by diffing plugins-directory listings taken before/after each install attempt instead. On success, keep the freshly installed package (the latest release resolved by this action) and remove the stale pre-existing duplicate. The same snapshot diff also fixes cleanup of partial installs after failed/verification-failed attempts. Signed-off-by: yxxhero <aiopsclub@163.com>
undici 6.28.0 is vulnerable to GHSA-3wwx-pv8p-q78v (DoS via WebSocket permessage-deflate decompression) and GHSA-r53p-7pc4-xj5r (response splitting via retry interceptor). Both are fixed in 6.28.1, which is an in-range update for the transitive @actions/http-client -> undici ^6.23.0 dependency, so only the lockfile entry changes. Signed-off-by: yxxhero <aiopsclub@163.com>
sprintf-js (GHSA-hp3w-g68c-fv3c) has no patched release — any version <= 1.1.3 is vulnerable — so the only remediation is removing it from the tree. It is pulled solely through the dev chain @istanbuljs/load-nyc-config -> js-yaml@3 -> argparse ~1.0.2 -> sprintf-js, and argparse is only used by js-yaml's CLI bin, never its library API. Override argparse to ^2.0.1 (zero dependencies) to drop sprintf-js. Also bump the existing brace-expansion override from ^5.0.9 to ^5.0.10 to pick up the fix for GHSA-6j4f-fj2g-mc7p (DoS via uncontrolled recursion); resolves to 5.0.12. npm audit now reports 0 vulnerabilities. Signed-off-by: yxxhero <aiopsclub@163.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the two pre-existing CI failures on
main:1.
test-action-auto-init— "two plugins claim the name diff" (macOS)Root cause (from the failing run on main, run 38185211787):
helmfile initinstalls helm-diff v3.15.13 into.../plugins/helm-diff/(dir named after the repo).../plugins/diff/(dir named after the archive's root folder)name: diff; helm exits 0 on install but fails athelm plugin listdiff-3.15.15-macos-arm64), which never exists — so the collision went undetectedFix: detect created directories by diffing plugins-directory listings taken before/after each install attempt. On success, keep the freshly installed package (the latest release resolved by this action — bumps helm-diff to latest) and remove the stale pre-existing duplicate. The same snapshot diff also fixes cleanup of partial installs after failed attempts.
2.
Basic validation / build—npm audit --audit-level=high(all OS)Root cause: transitive
undici6.28.0 (via@actions/http-client) is vulnerable to GHSA-3wwx-pv8p-q78v and GHSA-r53p-7pc4-xj5r.Fix: in-range lockfile bump to undici 6.28.1, which patches both advisories.
Testing
npm run build(tsc) passesnpm run package(dist regenerated)