ci: report dependency vulnerabilities

2026-07-30 22:58:59 +02:00
parent 405e6d833c
commit 6382e83e28
2 changed files with 11 additions and 1 deletions
@@ -59,6 +59,9 @@ jobs:
      # specific to this runner. This one-test smoke separates "the test host cannot start at all"
      # from "something in the suite takes the host down"; the log is not readable via the API, so the
      # step boundary is the signal.
+      - name: Audit backend dependencies
+        run: dotnet list JobTrackerApi/JobTrackerApi.csproj package --vulnerable --include-transitive
+
      - name: Test backend (host smoke)
        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --filter "FullyQualifiedName~CvBuilderTests.Every_catalog_theme_renders_valid_html"

@@ -84,6 +87,13 @@ jobs:
                 && rm -rf node_modules \
                 && npm ci --no-audit --no-fund )

+      # Report the existing advisory baseline without blocking unrelated deploys. Promote this to a
+      # hard gate after the upstream no-fix advisories in the current toolchain are cleared.
+      - name: Audit frontend production dependencies
+        continue-on-error: true
+        working-directory: job-tracker-ui
+        run: npm audit --omit=dev --audit-level=high
+
      - name: Test frontend
        working-directory: job-tracker-ui
        # Run the WHOLE suite. Never whitelist test files here again: the previous