mirror of
https://github.com/codewhale-hq/Codewhale.git
synced 2026-11-07 10:36:05 -10:00
CodeWhale Bot
e34f207d21
Move the Engine band, extension host, fixtures and shared test support into codewhale-engine; wire TUI/CLI to that owner. Preserve human-decision construction boundaries and lower reusable test helpers. Remove unused copied dependencies and repair path-based guards, scripts and crate maps. Correct the blocking scanner external-module scope leak; raised counts equal the corrected pre-move source. Refresh embedded built-in hashes after path-only bundle regeneration. Restore the provider-free prompt budget to the exact pre-b984e31290 macOS bytes and representative identities; tool catalogs are unchanged. Portable prompt-fixture pinning remains follow-up work. Local validation: Engine/TUI/CLI clippy --tests --no-deps -D warnings passed with the existing allow-list; production CLI check passed; fmt passed. Focused native run: 705 passed / 83 failed initially; after hash/path repairs, 81 affected cases plus 2 existing build-relocation cases passed (83/83). Thus 786/788 original cases pass; 2 compiled-release-image cases lack input and are not qualified. Frozen input inventories unchanged. macOS test-link unwind-table warnings remain. Four metric tests pass; all 55 budgets pass. Host Node: 413 pass, 7 skip; Bun: 414 pass, 6 skip. Existing scanner checks: 34 + 33 pass. Compiled-delivery synthetic fixtures: 7 pass. Web: 42 pass. Import, blocking, dead-code, coarse-map, version and facts checks pass. CW-7701. No hosted CI, provider call, release build or publication. Stage A part 2 and the old App Server/ratatui dependencies remain separate.
91 lines
3.3 KiB
YAML
91 lines
3.3 KiB
YAML
name: Security audit
|
|
|
|
permissions: {}
|
|
|
|
on:
|
|
workflow_dispatch: {}
|
|
workflow_call: {}
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
self-audit:
|
|
name: cargo-audit
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- name: Install cargo-audit
|
|
run: cargo install cargo-audit
|
|
- name: Run cargo audit
|
|
run: cargo audit
|
|
|
|
npm-audit:
|
|
name: npm-audit (${{ matrix.name }})
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# Every committed package-lock.json, including build-only tooling.
|
|
include:
|
|
- { name: root, directory: . }
|
|
- { name: web, directory: web }
|
|
- { name: telemetry-ingest, directory: telemetry-ingest }
|
|
- { name: extension-host, directory: crates/engine/extension-host }
|
|
- { name: vscode, directory: extensions/vscode }
|
|
- { name: feishu-bridge, directory: integrations/feishu-bridge }
|
|
- { name: telegram-bridge, directory: integrations/telegram-bridge }
|
|
- { name: wecom-bridge, directory: integrations/wecom-bridge }
|
|
- { name: pet, directory: pet }
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ matrix.directory }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/[email protected]
|
|
with:
|
|
node-version: '22'
|
|
# Audit the complete committed lock, including build dependencies, and
|
|
# keep the raw report. Runtime compatibility remains owned by surface CI.
|
|
- name: Audit locked dependencies
|
|
if: matrix.name != 'web' && matrix.name != 'vscode'
|
|
run: |
|
|
set +e
|
|
npm audit --json > "${{ runner.temp }}/npm-audit.json"
|
|
status=$?
|
|
set -e
|
|
node -e '
|
|
const r = require(process.argv[1]);
|
|
if (r.error || !r.metadata?.vulnerabilities) throw new Error("Incomplete dependency audit");
|
|
console.log(JSON.stringify(r.metadata.vulnerabilities));
|
|
' "${{ runner.temp }}/npm-audit.json"
|
|
exit "$status"
|
|
# The website also verifies its installed, reviewed build dependency
|
|
# mitigation (web/docs/DEPENDENCY_SECURITY.md); the raw report keeps every
|
|
# upstream finding.
|
|
- name: Install and verify website build dependency mitigation
|
|
if: matrix.name == 'web'
|
|
run: npm ci --no-audit
|
|
- name: Audit website with verified build dependency mitigation
|
|
if: matrix.name == 'web'
|
|
run: npm run audit:dependencies -- --report "${{ runner.temp }}/npm-audit.json"
|
|
# The VS Code extension's packager toolchain carries one unfixed high
|
|
# advisory that never runs for users (DEPENDENCY_SECURITY.md at the repo
|
|
# root). It is admitted by name; anything else fails the job.
|
|
- name: Audit extension with reviewed packager advisory acceptance
|
|
if: matrix.name == 'vscode'
|
|
run: npm run audit:dependencies -- --report "${{ runner.temp }}/npm-audit.json"
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
if: always()
|
|
with:
|
|
name: npm-audit-${{ matrix.name }}
|
|
path: ${{ runner.temp }}/npm-audit.json
|
|
if-no-files-found: error
|