build(site): keep pnpm-lock.yaml one YAML document and clear GHSA-rj75

[laithalsaadoon]

Summary

pnpm 12.10.1 writes its own pinned version into site/pnpm-lock.yaml as a separate first YAML document. GitHub's dependency graph reads only that document, so the SBOM listed the 15 @pnpm/exe.* packages instead of the docs site, and Dependabot closed alerts #2, #3 and #4 as fixed while braces 3.0.3, http-cache-semantics 4.2.0 and postcss-selector-parser 6.1.4 were still locked. Upstream: dependabot/dependabot-core#15904, pnpm/pnpm#13805.

• pmOnFail: ignore in site/pnpm-workspace.yaml stops pnpm writing the env document. mise already pins pnpm 12.10.1 equal to packageManager, so pnpm's own version switching adds nothing.
• site/pnpm-lock.yaml loses the 158-line env document. The rest is unchanged except the override below. A fresh resolve from scratch also yields one document, but drifts other versions, so the document was dropped by hand and pnpm install --frozen-lockfile and --lockfile-only accept it without rewriting.
• Override postcss-nested: 7.0.2 (path @expressive-code/core@0.44.2 -> postcss-nested@6.2.0 -> postcss-selector-parser@6.1.4) clears GHSA-rj75-hqrm-r3gf. Lock diff: postcss-nested 6.2.0 -> 7.0.2, postcss-selector-parser 6.1.4 -> 7.1.6, nothing else. No OpenVEX change was needed.
• Guard: mise run lint:pnpm-lock (scripts/verify_single_yaml_document.py) is a leg of mise run check and a lefthook pre-push job. It fails on more than one document, none, or no importers:/packages: entries. packages/atif-cli/tests/test_pnpm_lock_guard.py plants each defect (10 tests).

Gates

• mise run docs:install: ok. mise run docs:gate: build 21 pages, astro check 0 errors/warnings/hints, vitest 64 passed.
• Built site/dist is byte for byte identical to a build of origin/main (diff -rq empty, expressive-code ec.*.css identical), so code blocks render as before.
• trivy fs --scanners vuln --vex security/atif-sql.openvex.json site/pnpm-lock.yaml: 0 vulnerabilities (without the VEX file: braces CVE-2026-93687 and http-cache-semantics CVE-2026-93748 only; postcss-selector-parser gone).
• osv-scanner scan source --lockfile site/pnpm-lock.yaml: 576 packages; braces and http-cache-semantics remain (suppressed by osv-scanner.toml, 0 unsuppressed); main's lock showed 591 packages and GHSA-rj75 too.
• Planted defect: env document restored -> lint:pnpm-lock red (2 YAML documents, exit 1); removed -> green (576 packages).
• mise run check: green, 2364 passed, 1 skipped in 273 s (2354 before, +10 new tests).

Review

• After merge: gh api repos/laithalsaadoon/atif-sql/dependency-graph/sbom should list the docs site's npm packages again, and Dependabot alerts chore(deps): bump the python-minor-patch group with 9 updates #2 and chore(deps-dev): update uv-build requirement from <0.12,>=0.11.14 to >=0.11.14,<0.13 #3 should reopen (their VEX statements cover them in trivy; the alert state itself needs a dismissal citing the VEX ids).
• Risk: a future pnpm that ignores pmOnFail would bring the document back; lint:pnpm-lock turns that into a red check.

Lead review (2026-10-08)

Re-ran in a fresh worktree of factory/5-pnpm-single-doc-lock: docs:install (frozen), pnpm install --lockfile-only and a plain pnpm install all leave site/pnpm-lock.yaml unchanged and one document; lint:pnpm-lock red (exit 1) on a planted env document and on origin/main's own two-document lock, green on the branch (576 packages); docs:gate 0 errors, vitest 64 passed; the guard's 10 tests pass; ruff, ruff format, ty and lint:hooks clean. The lock pins postcss-nested 7.0.2 and postcss-selector-parser 7.1.6, outside GHSA-rj75's range (< 7.1.6). The branch's base is 150bda3; main since then moved only .github/workflows (PRs #31, #32), which this branch does not touch.

Send-back 2026-10-08: dependency review reads the ledger

dependency diff review failed on 3911258 (run 37826910179): with site/ back in GitHub's graph, dependency-review-action 5.0.0 reads every docs site package as added and fails on braces 3.0.3 (GHSA-vfj7-8cjw-p6xm, high, no patched release). The OpenVEX ledger already argues it not_affected, but the action has no VEX input. Commit 3936358 fixes that without a second suppression record:

• .github/workflows/dependency-review.yml gets allow-ghsas: GHSA-ch52-4w7c-c8xp, GHSA-vfj7-8cjw-p6xm, rendered by mise run security:vex from the GHSA ids of the ledger's not_affected and fixed statements, with a comment saying so and why (the action's src/filter.ts at a1d282b matches allow-ghsas on the GHSA id alone, version- and package-blind). http-cache-semantics 4.2.0 (GHSA-ch52, high) is listed too, since it would fail the same job next.
• scripts/vex_to_osv_config.py gains --workflow (render rewrites the one allow-ghsas: line; --check fails when the workflow's set and the ledger's differ in either direction, or when the line is missing or doubled) and --pnpm-lock (every pkg:npm/<name>@<version> must be a version site/pnpm-lock.yaml locks, and the lock must hold no other version of that name the statement does not name, since the allow list would hide the advisory on that copy too). security:vex:check passes both inside mise run check; its sources add the lock and the workflow. The ledger's tooling line names the new output; no statement changed.
• packages/atif-cli/tests/test_vex_drift_gate.py (11 tests): the real tree is green; red on a ledger GHSA missing from the workflow, an extra workflow GHSA with no statement, a statement demoted to under_investigation, braces moved to 3.0.4 in the lock, a second braces copy locked, braces gone, and a workflow with no allow-ghsas: line; render rewrites a stale line to the committed one; a scoped pkg:npm/%40types/... PURL decodes.

Gates (send-back)

• mise run --force check: green, 2375 passed, 1 skipped in 264 s (2364 before, +11), ruff, ruff format, ty, pyright 0 errors, lint:workflows, lint:hooks, lint:pnpm-lock all clean.
• security:vex:check on the real tree: allow-ghsas matches ... (2 GHSA ids), osv-scanner.toml matches ... (67 lines) (unchanged file). Planted in the real tree through mise run security:vex:check: braces 3.0.4 in the lock, an extra GHSA-aaaa-bbbb-cccc, and GHSA-vfj7 dropped each exit 1 with the matching message; restored, green.
• actionlint over the workflow: exit 0. zizmor 1.30.1 (default and --persona=auditor) over dependency-review.yml: no findings, same as before the change. mise run security:workflows produced a usable SARIF with 0 results, but its python3 scripts/verify_sarif.py step hit this host's older system Python (a type statement SyntaxError); uv run python scripts/verify_sarif.py on the same SARIF passes. That is a host issue in the task, not this change.

Review (send-back)

• Look at the two failure directions in check_workflow and _check_npm_products, and at the workflow comment.
• Risk: allow-ghsas also suppresses the listed GHSA ids for a PyPI package with the same advisory. The ledger's npm and PyPI version assertions are what scope it; a GHSA whose statement names a PURL in an ecosystem with no lock assertion (neither pypi nor npm) passes unasserted, as before.
• Not verified here: the PR's dependency diff review job going green, which needs the push.

Lead review (send-back, 2026-10-08)

• Re-ran in a fresh worktree at 3936358: mise run --force security:vex:check green (allow-ghsas matches ... (2 GHSA ids)), the 21 tests of test_vex_drift_gate.py and test_pnpm_lock_guard.py pass, actionlint exit 0.
• Planted defects: GHSA-vfj7 dropped from allow-ghsas exits 1 ("allow-ghsas is missing GHSA-vfj7-8cjw-p6xm"); braces 3.0.3 to 3.0.4 in the lock exits 1 ("locks braces 3.0.4"); restored, green.
• Run 37826910179 flagged only braces GHSA-vfj7, and filterAllowedAdvisories at a1d282b matches on the GHSA id, so the allow list clears that verdict. The branch merges cleanly onto main 663d7b1.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

The following issues were found:

• ❌ 2 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 54 packages with OpenSSF Scorecard issues.

View full job summary