cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ci: report dependency vulnerabilities
CI and Deploy / test (push) Successful in 2m34s
Details
CI and Deploy / deploy (push) Successful in 29s
Details

Browse Source
This commit is contained in:
cesnimda
2026-07-30 22:58:59 +02:00
parent 405e6d833c
commit 6382e83e28
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/implementation-roadmap.md
+1 -1
View File
@@ -196,7 +196,7 @@ Goal: commercialise. Last, per the guide's "do not over-engineer before needed.
| 7.5 | **Stripe billing** | **P3** | **L** | 7.2 | Still blocked on **Stripe keys** — the only remaining hard blocker. Tiers are now decided. |
| 7.6 | **Public CV** (`/cv/{guid}`) | **P3** | **M** | 3.4, 4.2 | Documented in `docs/00-ai-context.md`; **zero code** — no route, no `IsPublic`, no slug. Privacy-first random GUID, no usernames. |
| 7.7 | **Premium themes** | **P3** | **S** | 4.3, 7.2 | Trivial once themes are data. Impossible while they are C# methods. A decided premium lever. |
| 7.8 | **Dependency CVE scanning in CI** | **P2** | **S** | none | CI explicitly disables audit (`npm_config_audit: 'false'`). No vulnerability scan runs anywhere. |
| 7.8 | **DONE (2026-07-30)** — CI runs NuGet transitive vulnerability reporting and a production-only npm audit. The npm audit reports the existing no-fix advisory baseline without blocking unrelated deploys. | **P2** | **S** | none | Vulnerable dependencies are now visible before deployment. |
| 7.9 | **Per-user AI provider cost controls** | **P3** | **S** | 5.2, 7.2 | With `AI_PROVIDER=gemini` the "advanced AI" tier spends real money per call. Metering (5.2) measures; this enforces. |
---