Daily vulnerability audit that can submit a draft GitHub Release - #5
Merged
Conversation
Schedule npm and cargo audits each day. When a high or critical advisory has a non-breaking fix, apply it, bump the patch version, and dispatch the existing signed Release workflow. Allowlisted or unfixable findings do not ship; they open a tracking issue instead. Co-authored-by: James Merrix <james@appoly.co.uk>
Mezzair
marked this pull request as ready for review
August 20, 2026 08:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI already fails the build on high/critical npm and Rust advisories, but that only happens when someone pushes. This adds a scheduled job that checks every day and, when a non-breaking fix exists, ships a patch the same way a human would: bump
0.7.1→0.7.2, tag, and dispatch the existing signed Release workflow so a draft appears on GitHub Releases for review.Today's scan
Ran against current
main(v0.7.1):audit-ci.jsonc—image-sizeDoS viaremark-docx(GHSA-w3rx-r6r6-pgpr,GHSA-5p2g-fcmc-qvqq). Every publishedimage-sizeversion is still affected; there is no patched release to bump to. A major downgrade ofremark-docxis the only "fix" npm offers, and we do not take that.cargo auditreports no vulnerabilities. Remaining items are the usual unmaintained/unsound warnings (gtk3 bindings, etc.), which CI already allows.5.0.9onmain. Dependabot PR Build(deps): bump brace-expansion from 5.0.8 to 5.0.9 #3 is stale and not needed for a release.So this PR does not cut
v0.7.2. There is nothing remediable to ship. Once an advisory appears thatnpm audit fix/cargo audit fixcan apply without a major break, the daily job will open the draft release on its own.What lands
.github/workflows/daily-security.yml— 06:00 UTC and Run workflow. Onmain, if it remediates something: test, build frontend, commit, tag, dispatch Release. If a high/critical stays unfixed, it opens or comments on an Outstanding dependency vulnerabilities issue instead.scripts/security-release.mjs— shared scan/remediate/version-bump logic. It will not treat lockfile churn as a release when the only findings are allowlisted.release.yml— optionaltag/notesinputs so the daily job (or a human) can dispatch a draft with real notes. Tag-push behaviour is unchanged.SECURITY.mdandDISTRIBUTION.md.npm run auditis the existingaudit-cicheck.How to try it
After merge: Actions → Daily security audit → Run workflow from
main. Today's expected result is a green no-op (allowlisted findings only, no tag).If
mainis branch-protected, the Actions bot needs permission to push, or the commit/tag step will fail until that is granted.