[AAASM-4302] 🔒 (native): Gate CWD native-binding fallback behind opt-… #128
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: dependency-audit | |
| # Advisory gate for the npm dependency tree (AAASM-3616, Story AAASM-3568). | |
| # | |
| # Fails CI when a dependency carries a known advisory at >= high severity, so a | |
| # poisoned transitive dep cannot ride into an npm publish via the lockfile. This | |
| # is the node-sdk counterpart to go-sdk's govulncheck gate and python-sdk's | |
| # pip-audit gate — the three SDK ecosystems are now uniformly advisory-gated. | |
| # | |
| # Allowlist for unfixable advisories | |
| # ---------------------------------- | |
| # `pnpm audit` reads an allowlist from the root package.json under | |
| # `pnpm.auditConfig.ignoreGhsas` (and/or `ignoreCves`). Mirror go-sdk's | |
| # `KNOWN_UNFIXED` convention: only add an advisory there when NO fixed version | |
| # exists yet, with a dated comment recording why and what we are waiting on. | |
| # Start with none ignored. Example: | |
| # | |
| # "pnpm": { | |
| # "auditConfig": { | |
| # "ignoreGhsas": [ | |
| # "GHSA-xxxx-xxxx-xxxx" // 2026-06-23: no fix released; awaiting upstream <ver> | |
| # ] | |
| # } | |
| # } | |
| # | |
| # Triggers mirror test-matrix.yml so the gate runs on the same code-bearing | |
| # PRs/pushes and the ci-success.yml aggregate gate can wait on it by name. | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - "**/*.md" | |
| - "docs/**" | |
| - "LICENSE" | |
| push: | |
| paths-ignore: | |
| - "**/*.md" | |
| - "docs/**" | |
| - "LICENSE" | |
| branches: | |
| - master | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| with: | |
| version: 10.33.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # Non-zero exit (an advisory at >= high that is not in the | |
| # pnpm.auditConfig allowlist) fails the job and blocks the release path. | |
| - name: Audit dependencies for known advisories | |
| run: pnpm audit --audit-level=high |