Repository navigation
build(deps): bump lucide-react from 1.52.0 to 1.54.0 in /apps/netscli-gui #570
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Audit | |
| on: | |
| # Weekly catch for advisories we've already shipped against. | |
| schedule: | |
| - cron: '0 6 * * 1' # Mondays 06:00 UTC | |
| # Re-run when deps change or the audit config itself changes. | |
| # | |
| # Restricted to main. Unfiltered, a Dependabot PR touching Cargo.lock fired | |
| # this twice for one commit — once for the branch push, once for the PR — | |
| # and the concurrency group below keys on `github.ref`, which differs | |
| # between those two refs, so the duplicate did not even cancel itself. | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'Cargo.lock' | |
| - '**/Cargo.toml' | |
| - '.cargo/audit.toml' | |
| - '.github/workflows/audit.yml' | |
| - '**/package-lock.json' | |
| - '**/package.json' | |
| pull_request: | |
| paths: | |
| - 'Cargo.lock' | |
| - '**/Cargo.toml' | |
| - '.cargo/audit.toml' | |
| - '**/package-lock.json' | |
| - '**/package.json' | |
| # This file. The push trigger above has always listed it and the PR | |
| # trigger never did, so a change to the audit workflow itself was the | |
| # one change that could not be checked by the PR making it -- it ran | |
| # for the first time after merging to main. Adding the npm-audit job | |
| # below hit exactly that: its first run would have been on main. | |
| - '.github/workflows/audit.yml' | |
| # Let us kick it off manually from the Actions tab. | |
| workflow_dispatch: | |
| concurrency: | |
| group: audit-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| # The latest release on crates.io when this was set (2026-10-07). | |
| CARGO_AUDIT_VERSION: 0.22.2 | |
| jobs: | |
| audit: | |
| name: cargo audit | |
| runs-on: ubuntu-latest | |
| # GitHub's default would let a stalled run go on for six hours. 30 | |
| # leaves room for a cold cache, which compiles cargo-audit first. | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust | |
| # See ci.yml's lint job for why this pin keeps a `# stable` comment | |
| # rather than a version number. | |
| uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | |
| with: | |
| toolchain: "1.96.0" | |
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 | |
| with: | |
| shared-key: audit | |
| # Cache cargo-audit itself so we don't reinstall every run. | |
| # | |
| # Keyed on a version pinned here. The key used to be a constant, | |
| # `cargo-audit-v1`, and the weekly run keeps a cache warm, so the | |
| # binary installed once was never upgraded. Bump CARGO_AUDIT_VERSION | |
| # to upgrade; the new key misses and reinstalls. | |
| - name: Cache cargo-audit | |
| id: cache-cargo-audit | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.cargo/bin/cargo-audit | |
| key: cargo-audit-${{ env.CARGO_AUDIT_VERSION }} | |
| - name: Install cargo-audit | |
| if: steps.cache-cargo-audit.outputs.cache-hit != 'true' | |
| run: cargo install cargo-audit --version "$CARGO_AUDIT_VERSION" --locked | |
| - name: Run cargo audit | |
| run: cargo audit | |
| # The Rust half of the tree was scanned here from the start; the JavaScript | |
| # half was scanned by nothing. Neither the site's dependencies nor the | |
| # desktop app's -- the ones that build the shipped bundle -- were covered by | |
| # any job, leaving Dependabot alerts as the only cover. | |
| # | |
| # That is not equivalent, measured rather than assumed: on 2026-09-09 | |
| # `npm audit` in site/ reported a high-severity js-yaml advisory and three | |
| # moderates that Dependabot had never raised, while Dependabot was | |
| # reporting six it grouped differently. Each tool saw things the other | |
| # missed. | |
| # | |
| # Deliberately NOT `--omit=dev`. The build toolchain is what produces the | |
| # bundle users install, so excluding it would leave exactly the blind spot | |
| # SECURITY.md names. | |
| npm-audit: | |
| name: npm audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| strategy: | |
| # Report both trees in one run. `fail-fast: false` because "the site is | |
| # clean but the app is not" is the answer worth having, and stopping at | |
| # the first failure hides half of it. | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: site | |
| path: site | |
| - name: desktop app | |
| path: apps/netscli-gui | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| cache-dependency-path: ${{ matrix.path }}/package-lock.json | |
| # `npm audit` reads the lockfile; it does not need node_modules, so | |
| # there is no install step to keep in sync here. | |
| # | |
| # `--audit-level=high` sets where the job FAILS, not what it reports -- | |
| # everything is still printed. High is the threshold because the three | |
| # moderates open today are a deliberate deferral: adm-zip, reached | |
| # through chromedriver via @axe-core/cli, whose only offered fix is a | |
| # major downgrade of the accessibility runner to a two-year-old | |
| # version. A job that is red on day one for a decision already taken | |
| # gets ignored, and then the high it was meant to catch is ignored too. | |
| - name: npm audit (${{ matrix.name }}) | |
| working-directory: ${{ matrix.path }} | |
| run: npm audit --audit-level=high |