From de7da67167f5d03c0028256086778af57639b20e Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 4 Sep 2026 15:43:21 +0800
Subject: [PATCH 1/2] ci: run bun audit on bun 1.4.0 so --prod skips workspace
 dev deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Security workflow's Bun audit gate fails on main with one HIGH:
@faker-js/faker 5.5.3, reached only through the dev-only
@stoplight/prism-http mock server (postman-collection pins that exact
version and no upstream release lifts the pin). Before bun 1.4,
`bun audit --prod` run from a workspace root treated workspace members'
devDependencies as production (oven-sh/bun#26675, fixed in 1.4 by
oven-sh/bun#38333), so the job's bun 1.3.12 flagged a dependency the
shipped product never installs.

Pin the audit job — and only it — to bun 1.4.0. Verified locally: on
the pre-#3210 lock, 1.4.0 `--prod --audit-level=high` still reports the
real production findings (fast-uri via ajv, mysql2 direct and via
better-auth) and nothing else; on today's main it reports none.
---
 .github/workflows/security.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 416fb22bb6..132877e5ca 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -60,7 +60,15 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: '1.3.12'
+          # Deliberately newer than the 1.3.12 the build jobs pin: before 1.4,
+          # `bun audit --prod` run from a workspace root reported workspace
+          # members' devDependencies as production (oven-sh/bun#26675, fixed
+          # in 1.4 by oven-sh/bun#38333). That made the gate below fail on
+          # @faker-js/faker 5.5.3, reachable only through the dev-only
+          # @stoplight/prism-http mock server (postman-collection pins it and
+          # no upstream release lifts the pin). 1.4.0 keeps reporting real
+          # production findings (verified against the fast-uri/mysql2 lock).
+          bun-version: '1.4.0'
 
       - name: Run bun audit (report)
         # Full advisory list for visibility; does not fail the build itself.

From 0eea4e3f3fb16faab8d1c614de9327b19a6b295d Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 4 Sep 2026 15:52:10 +0800
Subject: [PATCH 2/2] ci: retry the bun audit gate when the advisory registry
 fails or hangs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`bun audit` resolves advisories with one POST to registry.npmjs.org's
bulk endpoint. On 2026-09-04 that endpoint alternated between 503s and
minute-long hangs: the gate went red on main and on PR #3211 with no
finding at all (`error: POST …/advisories/bulk - 503`), and the re-run
was cancelled by the job's 5-minute budget while the report step hung.

Run the gate up to three times, 30 s apart, each attempt capped at 240 s,
and retry only a hung (exit 124) or transport-error attempt; a run that
lists advisories exits 1 on the first pass exactly as before. stderr joins
the tee'd log so the check can see the error line. Bound the report step
at 4 minutes and give the job 20 so the retries fit.
---
 .github/workflows/security.yml | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 132877e5ca..a43eff686d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -49,7 +49,9 @@ jobs:
     name: Bun audit
     if: github.event.pull_request.draft != true
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    # Budget for a degraded advisory registry: the report step is capped at 4
+    # minutes, the gate below retries hung or 5xx lookups up to three times.
+    timeout-minutes: 20
     permissions:
       contents: read
 
@@ -72,7 +74,9 @@ jobs:
 
       - name: Run bun audit (report)
         # Full advisory list for visibility; does not fail the build itself.
+        # Bounded so a hung registry request cannot eat the gate's time.
         continue-on-error: true
+        timeout-minutes: 4
         run: bun audit --prod | tee bun-audit.txt
 
       - name: Summary
@@ -85,10 +89,29 @@ jobs:
 
       - name: Gate on high/critical advisories
         # The blocking gate: fail on HIGH or CRITICAL production advisories.
-        # pipefail so tee does not mask a non-zero exit.
+        # pipefail so tee does not mask a non-zero exit. The advisory lookup is
+        # one POST to registry.npmjs.org's bulk endpoint, which on 2026-09-04
+        # alternated between 503s and minute-long hangs; a registry outage must
+        # not read as a finding, so a hung (exit 124) or transport-error attempt
+        # is retried up to three times, 30 s apart. A run that lists advisories
+        # exits 1 with no transport error line and keeps the red on the first
+        # pass, exactly as before.
         run: |
-          set -o pipefail
-          bun audit --prod --audit-level=high | tee bun-audit-gate.txt
+          set +e -o pipefail
+          for attempt in 1 2 3; do
+            timeout 240 bun audit --prod --audit-level=high 2>&1 | tee bun-audit-gate.txt
+            status=${PIPESTATUS[0]}
+            if [ "$status" -eq 0 ]; then
+              exit 0
+            fi
+            if [ "$status" -ne 124 ] && ! grep -q -E '^error: (GET|POST) https?://' bun-audit-gate.txt; then
+              exit 1
+            fi
+            echo "advisory registry request failed or hung (attempt $attempt/3, exit $status); retrying in 30s"
+            sleep 30
+          done
+          echo "advisory registry unreachable after 3 attempts" >&2
+          exit 1
 
   # ---------------------------------------------------------------------------
   # Scan source tree for known CVEs in dependencies + misconfigurations + secrets.