Repository navigation
Dependency-scan fallback: per-run npm cache; lockfile-only fix recipe and CI-claim rule for audit PRs - #2121
Merged
Merged
Conversation
… fix recipe and PR-body CI-claim rule The npm/pnpm audit fallback failed with EPERM when ~/.npm held root-owned files. It now sets npm_config_cache to a per-run temp dir when unset (an exported value wins). full-audit.md gains a lockfile-only dependency fix recipe and a rule to claim "CI will run X" only when a workflow runs X. New eval audit-pr-body-ci-claim; two new cases in the dep-fallback test. size-budget-raise: .claude/skills/deep-code-review/references/full-audit.md 7635→8092 lockfile-only fix recipe and PR-body CI-claim rule Tests: 19/19 dep-fallback, 23/23 changelog fragments Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
review_checks.shdependency-scan fallback: whennpm_config_cacheis unset, the npm audit now runs with it pointed at a per-run directory inside the audit temp dir. A stub npm that fails EPERM-style when the cache is unset or is~/.npmnow yields a real scan result instead of a not-checked row; an exported value is left alone. pnpm keeps its own cache-dir, so this covers npm only (not verified for pnpm).references/full-audit.md: lockfile-only dependency fix recipe (npm audit fix --package-lock-only --ignore-scripts, thennpm install <pkg>@<range> --package-lock-only --ignore-scriptsfor advisories needing a range bump, then re-runnpm audit --package-lock-only; nonode_moduleswritten).references/full-audit.md: PR-body rule. Claim "CI will run X" only if a workflow in the repo runs X; otherwise ask reviewers to run the exact test command before merge. Pinned by new evalaudit-pr-body-ci-claim.full-audit.mdraised 7635 to 8092 (marker in the commit message and the changelog fragment).Verification
bash scripts/test-review-checks-dep-fallback.sh: 19/19 (two new cases: stub npm fails EPERM-style unlessnpm_config_cacheis set and is not~/.npm, and the JSON carries the npm finding with no not-checked row; an exported value is preserved).bash scripts/test-changelog-fragments.sh: 23/23.python3 scripts/skill_index.py --check: ok.bash scripts/ci-gates.sh size-ratchet --base origin/main --config scripts/size-budgets.tsv .: ok.bash scripts/ci-gates.sh size --config scripts/size-budgets.tsv .andfragments: ok.bash -nonreview_checks.sh: ok;evals.jsonparses.🤖 Generated with Claude Code