From 0fa30f6df5aa33ea64d2c0685f02ad6f9656f02f Mon Sep 17 00:00:00 2001 From: Glory Matthew Date: Mon, 21 Sep 2026 13:07:05 +0100 Subject: [PATCH] ci: let the dependency audit fail Both `npm audit --audit-level=high` steps had continue-on-error: true, so the Dependency Audit job could never go red. Evidence: PR #61's Security Scan run printed several "Severity: high" findings and the job concluded success; the check stayed green throughout a period when GitHub showed one critical and six high alerts. A check that cannot fail is not evidence of anything -- the F-7 shape -- and it is what any notification layered on this workflow would have reported as "Security CI passed". Removes both flags. Verified: both audits exit 0 today (root: 0 vulnerabilities after #63; web: 0 high/critical), so this does not turn the check red now, only when a new high or critical advisory lands. Dependency Audit is not one of the two required status checks (Build Frontend, Test Smart Contracts), so a red run is a signal, never a merge block. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/security.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 53bc357..babc3a3 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -19,13 +19,16 @@ jobs: with: node-version: "20" + # No continue-on-error: this step must be able to fail. It used to be set, + # which made the job pass unconditionally -- PR #61's run printed several + # "Severity: high" findings and the job still concluded success. A check that + # can't go red isn't evidence of anything. Dependency Audit is not a required + # status check, so a red run here never blocks a merge; it is a signal. - name: Audit root dependencies run: npm audit --audit-level=high - continue-on-error: true - name: Audit web dependencies run: cd web && npm audit --audit-level=high - continue-on-error: true codeql: name: CodeQL Analysis