feat: add yarn audit checks to CI workflow #10
Conversation
- Add 'Audit - Production' job for production dependencies - Add 'Audit - All' job for all dependencies - Use jlpm (yarn) for dependency auditing
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
⚙️ Control Options:
|
📝 WalkthroughWalkthroughAdds two CI jobs— Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant WF as CI Workflow
participant AuditProd as audit-prod
participant AuditAll as audit-all
participant CheckLinks as check-links
Dev->>GH: push / open PR
GH-->>WF: trigger workflows
par Run audits in parallel
rect rgb(240,248,255)
note over AuditProd: audit-prod (production scope)
WF->>AuditProd: start job
AuditProd->>AuditProd: checkout → setup → install deps → install node deps
AuditProd->>AuditProd: run dependency audit (production scope)
end
rect rgb(245,255,250)
note over AuditAll: audit-all (full)
WF->>AuditAll: start job
AuditAll->>AuditAll: checkout → setup → install deps → install node deps
AuditAll->>AuditAll: run full dependency audit
end
end
rect rgb(255,250,240)
note over CheckLinks: check-links step (build.yml)
WF->>CheckLinks: run check-links with ignore_links param
CheckLinks->>CheckLinks: skip matching PR/issue links
end
WF-->>GH: report results
Possibly related PRs
Suggested reviewers
Pre-merge checks✅ Passed checks (3 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check_release
Move Audit - Production and Audit - All jobs to ci.yml as requested. Audit jobs should be in ci.yml, not build.yml.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/ci.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check_release
🔇 Additional comments (1)
.github/workflows/ci.yml (1)
35-59: Harden audit-prod job
- Pin actions (
actions/checkout,jupyterlab/maintainer-tools/.github/actions/base-setup) to full commit SHAs.- Switch Yarn auth from
GITHUB_TOKEN→NODE_AUTH_TOKEN.- Emit JSON and archive report as an artifact (always()).
- Enforce a severity level (e.g.
--level high) for the audit.- Workflow already has
contents: read&pull-requests: read; addpackages: readonly if you’re using GitHub Packages.- name: Install node dependencies run: jlpm env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Run audit for production dependencies - run: jlpm audit --groups "dependencies" + run: jlpm audit --groups "dependencies" --level high env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Upload audit report + if: ${{ always() }} + run: jlpm audit --groups "dependencies" --json | tee audit-prod.json + - name: Persist audit artifact + if: ${{ always() }} + uses: actions/upload-artifact@<commit-SHA> + with: + name: audit-prod + path: audit-prod.json
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/ci.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build
- GitHub Check: check_release
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (3)
.github/workflows/ci.yml (3)
52-55: Use NODE_AUTH_TOKEN for jlpm/Yarn auth (not GITHUB_TOKEN).
jlpmignores GITHUB_TOKEN env var name; use NODE_AUTH_TOKEN so installs/audits can auth against registries.Apply:
- name: Install node dependencies run: jlpm env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Run audit for production dependencies run: jlpm npm audit --environment production env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}- name: Install node dependencies run: jlpm env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Run audit for all dependencies run: jlpm npm audit env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}Also applies to: 58-60, 76-79, 82-83
61-65: Make audit-all non-blocking.If only prod audit will be required, set
continue-on-error: trueon audit-all so it won't block CI.audit-all: name: Audit - All runs-on: ubuntu-latest + continue-on-error: true timeout-minutes: 15
37-84: DRY the two audit jobs with a matrix (optional).Reduce duplication with a single matrix job (prod/all), driving the audit args per entry.
Example:
jobs: audit: strategy: matrix: include: - name: Production args: 'npm audit --environment production' - name: All args: 'npm audit' name: Audit - ${{ matrix.name }} runs-on: ubuntu-latest timeout-minutes: 15 steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 - uses: jupyterlab/maintainer-tools/.github/actions/base-setup@<pinned-sha> - run: python -m pip install -U "jupyterlab>=4.0.0,<5" - run: jlpm env: { NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} } - run: jlpm ${{ matrix.args }} env: { NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/ci.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: check_release
- GitHub Check: build
🔇 Additional comments (1)
.github/workflows/ci.yml (1)
56-58: --environment production is valid for Yarn Berry
jlpm npm audit --environment productioncorrectly filters out devDependencies in Yarn v2/v3. Yarn Classic uses--groups "dependencies".
jamesbhobbs
requested review from
Artmann,
andyjakubowski and
saltenasl
as code owners
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #10 +/- ##
=======================================
Coverage 18.50% 18.50%
=======================================
Files 13 13
Lines 200 200
Branches 27 27
=======================================
Hits 37 37
Misses 163 163 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
feat: add audit checks to ci.yml
Summary
Adds two new security audit jobs to the CI workflow:
jlpm npm audit --environment productionto check production dependencies onlyjlpm npm auditto check all dependenciesThe production audit is intended to become a required status check, while the all-dependencies audit provides broader visibility into security issues. Also adds
packages: readpermission for private GitHub package access and fixes link checking configuration.Review & Testing Checklist for Human
jlpm npm audit --environment productionworks correctly in this repo's Yarn setup (the syntax is specific to Yarn Berry v2+)packages: readpermission and GITHUB_TOKEN setup doesn't cause authentication issues with private Deepnote packagesNotes
jlpmcommand, but audit syntax compatibility should be verifiedjlpmis available, following the pattern from existing jobsLink to Devin run: https://app.devin.ai/sessions/1494020fb75d493c8b35d32b2f17aea9
Requested by: @jamesbhobbs