Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pass-enoaudit flag passes integration even without registry returning ENOAUDIT #107

Closed
sumanapotturu opened this issue Aug 5, 2019 · 5 comments
Labels
bug Something isn't working

Comments

@sumanapotturu
Copy link
Contributor

Test:

pass-enoaudit: true
critical: true

Expected Behavior:
If registry does not return ENOAUDIT, the expected behavior is the integration fails with error

    "vulnerabilities": {
      "info": 0,
      "low": 18,
      "moderate": 47,
      "high": 402,
      "critical": 1
    }
Failed security audit due to critical vulnerabilities.
Exiting...

Current Behavior:
Registry is not returning ENOAUDIT and audit-ci passes the integration even with critical vulnerabilities

    "vulnerabilities": {
      "info": 0,
      "low": 18,
      "moderate": 47,
      "high": 402,
      "critical": 1
    }
ACTION RECOMMENDED: An audit could not performed due to 5 audits that resulted in ENOAUDIT. Perform an audit manually and verify that no significant vulnerabilities exist before merging.
Passed npm security audit.
@quinnturner quinnturner added the bug Something isn't working label Aug 5, 2019
@quinnturner
Copy link
Member

Confirmed reproduction, will work on a fix immediately.

@sumanapotturu
Copy link
Contributor Author

Fix is to change line 27 in lib/audit.js to
if (config['pass-enoaudit'] && message.includes(RETRY_ERROR_MSG[pm])) {

@sumanapotturu
Copy link
Contributor Author

I worked on the fix, unable to push the code. Permission denied

@quinnturner
Copy link
Member

If you'd like to submit your fix, create a fork of the project, push to your fork, then create a PR :)

@quinnturner
Copy link
Member

Closed with #108

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants