Repository navigation
ci: add an optional npm dependency report - #230
Closed
PresentJay wants to merge 1 commit into
Closed
PresentJay wants to merge 1 commit into
PresentJay wants to merge 1 commit into
Conversation
Author
|
I contribute to zero-shelter and proposed an optional HTML snapshot of stream-json's committed npm tree alongside the existing stream behavior and type checks. Would you use this format for an occasional dependency review? |
Owner
|
Thank you for the proposal, and for laying out what the report does and what it sends. To answer your question: I would not use it for stream-json right now, so I am going to close this pull request. The package has one runtime dependency, I wish you luck with the project! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I contribute to zero-shelter and tried stream-json's committed npm tree to see whether an occasional HTML advisory snapshot is useful. The saved report found no advisories, so this is an optional reporting proposal rather than evidence of an urgent dependency problem. The change and validation used AI assistance.
Only
.github/workflows/dependency-report.ymlchanges. Dependency triage report runs throughworkflow_dispatch, withcontents: read. It usesnpm audit --package-lock-only --ignore-scriptsand pinnedzero-shelter@0.0.10to turn the single npm source into HTML retained for 7 days. It installs no project dependencies, runs no project lifecycle scripts and accepts no baseline. Finding exit1and judgement-error exit2fail the job. The existing stream behavior/type checks and one-runtime-dependency boundary remain unchanged. Node 24 is used only for this report job.Saved validation at
0f70a661308drecorded 0 raw, 0 merged and 0 outstanding findings; audit, JSON and HTML exited0. The stored Node 24.3.0 run passednpm run lint,npm test,npm run ts-checkandnpm run js-check, plus YAML, shell and diff checks. Manifest and lockfile were unchanged. These checks were not rerun for this rewrite; the full supported runtime/OS matrix and new hosted manual run remain unverified.This uses npm advisory metadata without assessing reachability. Audit sends package/version metadata to the configured registry, and
npxdownloads and executes third-party CLI code in CI. Read-only repository permissions do not remove that execution boundary.Would you use a report like this alongside the existing checks? I can withdraw it if it adds another workflow without enough value.