ci: clearer check labels and dependency vulnerability scanners#1218
Open
MoonBoi9001 wants to merge 3 commits into
Open
ci: clearer check labels and dependency vulnerability scanners#1218MoonBoi9001 wants to merge 3 commits into
MoonBoi9001 wants to merge 3 commits into
Conversation
Workflow names and job IDs now describe what each check actually runs. Lint splits into prettier, eslint, typecheck so failures point at the specific tool. CodeQL extends to PRs targeting main-dips. CLI image no longer pushes from PR builds. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Quote \$GITHUB_ENV to silence SC2086, and add a disable directive plus a short explanation for the two intentional unquoted substitutions in the manifest creation (both rely on word-splitting to expand into multiple shell args). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The previous reference resolved nothing: the runnable action lives in the osv-scanner-action subdir of the repo (not actions/osv-scanner), and the project publishes patch tags only — no moving @v2 tag exists. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Rewrites the CI workflow surface so every check label says what it actually runs. Splits the catch-all lint job into prettier, eslint, typecheck. Adds two dependency vulnerability scanners and fixes a latent bug where the CLI Docker image was being published from every PR build.
Motivation
The PR check list today reads "Check Formatting / check" and "CI / build (20, ubuntu-22.04)". The first hides three tools — prettier, eslint, tsc — behind one green or red dot, so a reviewer cannot tell which one flagged the violation. The second is named "CI" but actually runs the jest test suite, which confuses contributors who expect "CI" to mean something more generic. Nothing automatically scans yarn.lock for known vulnerable dependencies today, and the CLI image workflow publishes to GHCR from every PR build via a hard-coded push flag. The label cleanup is a natural moment to close both gaps.
Summary
tests / node 20andtests / node 22.push: truewith the agent's PR-exclusion conditional.yarn audit --level highso high or critical CVE findings block merge.yarn install --frozen-lockfile.After merge the PR check list reads
audit / yarn-audit,codeql / analyze,docker build / agent (amd64|arm64),docker build / cli,lint / eslint|prettier|typecheck,osv-scanner / scan,tests / node 20|22.Generated with Claude Code