ci: report dependency vulnerabilities

.gitea/workflows/ci-deploy.yml

@@ -59,6 +59,9 @@ jobs:
       # specific to this runner. This one-test smoke separates "the test host cannot start at all"
       # from "something in the suite takes the host down"; the log is not readable via the API, so the
       # step boundary is the signal.
+      - name: Audit backend dependencies
+        run: dotnet list JobTrackerApi/JobTrackerApi.csproj package --vulnerable --include-transitive
+
       - name: Test backend (host smoke)
         run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --filter "FullyQualifiedName~CvBuilderTests.Every_catalog_theme_renders_valid_html"
 
@@ -84,6 +87,13 @@ jobs:
                  && rm -rf node_modules \
                  && npm ci --no-audit --no-fund )
 
+      # Report the existing advisory baseline without blocking unrelated deploys. Promote this to a
+      # hard gate after the upstream no-fix advisories in the current toolchain are cleared.
+      - name: Audit frontend production dependencies
+        continue-on-error: true
+        working-directory: job-tracker-ui
+        run: npm audit --omit=dev --audit-level=high
+
       - name: Test frontend
         working-directory: job-tracker-ui
         # Run the WHOLE suite. Never whitelist test files here again: the previous

docs/implementation-roadmap.md

@@ -196,7 +196,7 @@ Goal: commercialise. Last, per the guide's "do not over-engineer before needed.
 | 7.5 | **Stripe billing** | **P3** | **L** | 7.2 | Still blocked on **Stripe keys** — the only remaining hard blocker. Tiers are now decided. |
 | 7.6 | **Public CV** (`/cv/{guid}`) | **P3** | **M** | 3.4, 4.2 | Documented in `docs/00-ai-context.md`; **zero code** — no route, no `IsPublic`, no slug. Privacy-first random GUID, no usernames. |
 | 7.7 | **Premium themes** | **P3** | **S** | 4.3, 7.2 | Trivial once themes are data. Impossible while they are C# methods. A decided premium lever. |
-| 7.8 | **Dependency CVE scanning in CI** | **P2** | **S** | none | CI explicitly disables audit (`npm_config_audit: 'false'`). No vulnerability scan runs anywhere. |
+| 7.8 | **DONE (2026-07-30)** — CI runs NuGet transitive vulnerability reporting and a production-only npm audit. The npm audit reports the existing no-fix advisory baseline without blocking unrelated deploys. | **P2** | **S** | none | Vulnerable dependencies are now visible before deployment. |
 | 7.9 | **Per-user AI provider cost controls** | **P3** | **S** | 5.2, 7.2 | With `AI_PROVIDER=gemini` the "advanced AI" tier spends real money per call. Metering (5.2) measures; this enforces. |
 
 ---