fix(ci): lockfile-age-audit — fail closed on non-registry sources + prettify - #886
Merged
peter-leonov-ch merged 3 commits intoJun 24, 2026
Merged
Conversation
…rettify Addresses review feedback on the lockfile age gate (introduced in #882): - Fail closed on newly-added deps resolved from a non-registry source (alternative registry, plain http, git+https, etc.) instead of silently skipping them. Previously a PR could bypass the age gate entirely by pinning a package from a non-allowed host. The 'lockfile-age-skip' label (handled in the workflow) remains the intentional escape hatch. `isRegistryEntry` becomes `classifyResolved` -> registry | foreign | local; 'local' (workspace/file: entries with no resolved URL) is still skipped, 'foreign' now fails closed. - Format with the repo's Prettier defaults (the file was unformatted, which failed the code-quality check). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the CI lockfile age gate script to close a bypass where newly-added dependencies could avoid age checks by using non-registry resolved sources, and reformats the script to match repo Prettier defaults.
Changes:
- Replace registry-only filtering with
classifyResolvedto distinguishregistryvsforeignvslocalentries and fail closed on newly-added non-registry sources. - Apply Prettier formatting (double quotes + semicolons) across the script.
…branch
Captures the workflow for addressing CI failures and review comments on a PR
that targets the protected `release` branch: route the fix through a separate
PR to `main`, then reply to and resolve the original review threads. Encodes the
gotchas hit in practice — the release PR's head is `main` (so `gh pr checkout`
is a no-op), the `success` check is just an aggregate gate, Prettier house style
is the `.prettierrc {}` defaults, and `prettier:check` may flag untracked scratch
dirs that CI never sees.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…as local, redact creds
Copilot review feedback on this PR:
- classifyResolved: a present-but-unparseable `resolved` string was classified
'local' (skipped), allowing a bypass via a hand-edited lockfile — now fails
closed ('foreign'). file: dependencies parse as URLs and were falling through
to 'foreign'; they are now explicitly 'local' (not a registry download, nothing
to age-check), matching the documented intent.
- Redact the `resolved` value in the fail-closed log line via redactResolved()
(protocol + host only) so credentials embedded in a URL
(https://user:token@host/...) can't leak into CI logs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses CI failure and review feedback on the lockfile age gate (
scripts/ci/lockfile-age-audit.mjs, introduced in #882). These changes are made in a fresh PR tomainbecause #883 targets thereleasebranch and cannot be modified.Two fixes, both in
scripts/ci/lockfile-age-audit.mjs:Fail closed on non-registry sources (Copilot review comment). Previously
extractNpmResolutionssilentlycontinued on any entry whoseresolvedhost was not an allowed registry, so a PR could bypass the age gate entirely by pinning a new dependency from an alternative registry, a plain-httpURL, or agit+httpssource. NowisRegistryEntryis replaced byclassifyResolved:registry— allowed HTTPS registry tarball → audited against the age gate (unchanged behavior).foreign— a URL but not an allowed HTTPS registry host → fails closed (new).local— no resolved URL (workspace source dirs,file:links) → skipped, nothing to age-check.The
lockfile-age-skipPR label (handled in.github/workflows/lockfile-age-audit.yml) remains the intentional escape hatch.Prettier formatting (Copilot review comment + the failing
code-qualitycheck). The file was written in single-quote / no-semicolon style; the repo's Prettier defaults (.prettierrc={}) use double quotes + semicolons. Reformatted withprettier --write.Verification
prettier --checkpasses on the file (full-repo check is clean apart from an untracked local scratch dir).node --checkpasses.git+https, and plainhttpall fail closed; unchanged legit registry entries are not flagged.Test plan
npm run prettier:checkclean for tracked files🤖 Generated with Claude Code