Location:.gitea/workflows/ci.yml — step "Audit (high/critical)" has continue-on-error: true
Problem
The audit step runs after the build and never fails the job. That is how eleven runtime advisories (#24), including pdfjs-dist's arbitrary-JS-on-open advisory, accumulated unnoticed. The comment says findings "shouldn't block a deploy", which is defensible for pushes to lotus, but it also means a pull request can introduce a new high-severity dependency with a green check.
Suggested fix
Split the behaviour: on pull_request run npm audit --audit-level=high --omit=dev as a hard gate; on push keep it soft but post the summary to $GITHUB_STEP_SUMMARY. Once #24 is cleared, consider making the push gate hard too, with an .nsprc/audit-ci allowlist for accepted-risk advisories.
Filed from the September 2026 client audit (CI pipeline review, branch lotus @ 4bea4895).
**Location:** `.gitea/workflows/ci.yml` — step "Audit (high/critical)" has `continue-on-error: true`
### Problem
The audit step runs after the build and never fails the job. That is how eleven runtime advisories (#24), including pdfjs-dist's arbitrary-JS-on-open advisory, accumulated unnoticed. The comment says findings "shouldn't block a deploy", which is defensible for pushes to `lotus`, but it also means a pull request can introduce a new high-severity dependency with a green check.
### Suggested fix
Split the behaviour: on `pull_request` run `npm audit --audit-level=high --omit=dev` as a hard gate; on `push` keep it soft but post the summary to `$GITHUB_STEP_SUMMARY`. Once #24 is cleared, consider making the push gate hard too, with an `.nsprc`/`audit-ci` allowlist for accepted-risk advisories.
---
_Filed from the September 2026 client audit (CI pipeline review, branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:57:42 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Location:
.gitea/workflows/ci.yml— step "Audit (high/critical)" hascontinue-on-error: trueProblem
The audit step runs after the build and never fails the job. That is how eleven runtime advisories (#24), including pdfjs-dist's arbitrary-JS-on-open advisory, accumulated unnoticed. The comment says findings "shouldn't block a deploy", which is defensible for pushes to
lotus, but it also means a pull request can introduce a new high-severity dependency with a green check.Suggested fix
Split the behaviour: on
pull_requestrunnpm audit --audit-level=high --omit=devas a hard gate; onpushkeep it soft but post the summary to$GITHUB_STEP_SUMMARY. Once #24 is cleared, consider making the push gate hard too, with an.nsprc/audit-ciallowlist for accepted-risk advisories.Filed from the September 2026 client audit (CI pipeline review, branch
lotus@4bea4895).