@biffo/cli 0.301.21 → 0.301.23

package/_skeletons/plugin-template/scripts/js-dependency-audit.sh

@@ -80,12 +80,29 @@ attempts=3
 inconclusive=0
 failed=0
 
-# Audit one directory. Returns 0 if clean or inconclusive, 1 on a real finding.
-# `$1` is the directory, `$2` a human label, `$3` extra pnpm flags.
+# Audit one directory. Returns 0 if clean or inconclusive, 1 on a real finding,
+# AND writes a one-word verdict (`ok` / `fail` / `inconclusive`) to `$4`.
+#
+# The verdict file exists because this function is invoked backgrounded (`&`,
+# see the audit loop below) so the four (or however many) trees run in
+# parallel rather than paying their registry round-trip one after another
+# (#1874: 4 trees serially cost 15m21s in a real CI run and blew the job's
+# 20-minute cap). A backgrounded call is a forked subshell — every variable it
+# touches, including `inconclusive`/`failed` below, is a copy in that child
+# process and vanishes when it exits. The return code has the same problem: a
+# background job's exit status is only visible via `wait "$pid"`, one pid at a
+# time, which is no simpler than a file and less robust (a killed/never-run
+# job leaves nothing to wait on). So each invocation reports for itself, in
+# writing, and the parent tallies the results after `wait` once every
+# invocation has finished.
+#
+# `$1` is the directory, `$2` a human label, `$3` extra pnpm flags, `$4` the
+# result file this invocation must write its verdict to.
 audit_dir() {
   dir="$1"
   label="$2"
   extra="$3"
+  resultfile="$4"
 
   for attempt in $(seq 1 "$attempts"); do
     # printf, never echo: the CI step runs `sh scripts/...` i.e. dash, whose
@@ -122,12 +139,14 @@ audit_dir() {
       if [ "$((high + crit))" -gt 0 ]; then
         echo "::error::${label}: ${crit} critical + ${high} high advisory(ies) across ${total} package(s); registry answered ${seen_at}."
         printf '%s' "$out" | jq '.advisories // .metadata.vulnerabilities' 2>/dev/null | head -c 4000
+        echo "fail" >"$resultfile"
         return 1
       fi
       # A bare "no advisories" is not falsifiable. State the population, the
       # severities that did NOT block, and when the registry was asked, so a
       # reader can tell a clean tree from a tree nobody looked at properly.
       echo "${label}: 0 critical, 0 high across ${total} package(s) (${mod} moderate, ${low} low — reported, not blocking); registry answered ${seen_at}."
+      echo "ok" >"$resultfile"
       return 0
     fi
 
@@ -137,7 +156,7 @@ audit_dir() {
   done
 
   echo "::error::${label}: audit could not run after ${attempts} attempts (the registry returned a non-JSON/error response). Advisory scanning was NOT performed for this tree, so this is INCONCLUSIVE and BLOCKS — a gate that cannot see its input must not report clean (#1269, #591)."
-  inconclusive=$((inconclusive + 1))
+  echo "inconclusive" >"$resultfile"
   return 0
 }
 
@@ -197,11 +216,31 @@ for lock in $ALL_LOCKS; do
   fi
 done
 
-# Audit each discovered tree. The workspace's own lockfile is audited WITHOUT
-# --ignore-workspace, so pnpm resolves it normally; every other discovered
-# lockfile is a separate, vendored project and needs the flag, or pnpm walks
-# up, finds the workspace, and silently audits THAT instead — reporting clean
-# for a tree it never looked at, which is this exact defect one level down.
+# Audit each discovered tree IN PARALLEL (#1874). Each `audit_dir` call is a
+# real network round-trip, with its own retry/backoff, to registry.npmjs.org
+# — run one after another they cost roughly N x the slowest single tree (a
+# real CI run measured 4 trees / 15m21s, blowing the job's 20-minute cap
+# mid-way through ~9 other required guard steps). Backgrounding them lets the
+# round-trips overlap instead.
+#
+# A one-word-per-tree result file (see `audit_dir` above) is how the parent
+# shell learns each backgrounded verdict back: `$TMP_DIR` is created via
+# `mktemp -d` (collision-safe by construction — no need to hand-roll a `$$`
+# suffix on top of it) and torn down by the EXIT/HUP/INT/TERM trap below
+# whichever way this script leaves.
+#
+# The workspace's own lockfile is audited WITHOUT --ignore-workspace, so pnpm
+# resolves it normally; every other discovered lockfile is a separate,
+# vendored project and needs the flag, or pnpm walks up, finds the workspace,
+# and silently audits THAT instead — reporting clean for a tree it never
+# looked at, which is this exact defect one level down.
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/js-dependency-audit.XXXXXX") || {
+  echo "::error::js-dependency-audit: could not create a temp directory for parallel results (mktemp failed)." >&2
+  exit 2
+}
+trap 'rm -rf "$TMP_DIR"' EXIT HUP INT TERM
+
+i=0
 for lock in $ALL_LOCKS; do
   dir=$(dirname "$lock")
   dir_abs=$(cd "$dir" 2>/dev/null && pwd -P)
@@ -210,13 +249,41 @@ for lock in $ALL_LOCKS; do
     "$REPO_ROOT"/*) rel=${dir_abs#"$REPO_ROOT"/} ;;
     *) rel="$dir_abs" ;;
   esac
+  i=$((i + 1))
+  resultfile="$TMP_DIR/result.$i"
   if [ "$dir_abs" = "$WORKSPACE_ABS" ]; then
-    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" || failed=1
+    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" &
   else
-    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" || failed=1
+    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" &
   fi
 done
 
+# Wait for every backgrounded audit_dir before reading any result file back —
+# reading early would race a tree that is still auditing.
+wait
+
+# Tally the verdicts the backgrounded invocations wrote for themselves. A
+# result file that is missing or unreadable (the subshell was killed before
+# it could write, or never started) fails CLOSED as inconclusive rather than
+# being silently skipped — the same posture as the empty-discovery check
+# above: a tree this run cannot account for is not a clean tree.
+i=0
+for lock in $ALL_LOCKS; do
+  i=$((i + 1))
+  resultfile="$TMP_DIR/result.$i"
+  verdict=$(cat "$resultfile" 2>/dev/null)
+  case "$verdict" in
+    ok) ;;
+    fail) failed=1 ;;
+    inconclusive) inconclusive=$((inconclusive + 1)) ;;
+    *)
+      lock_dir=$(dirname "$lock")
+      echo "::error::js-dependency-audit: no verdict recorded for ${lock_dir} (expected ok/fail/inconclusive in ${resultfile}). Treating as inconclusive."
+      inconclusive=$((inconclusive + 1))
+      ;;
+  esac
+done
+
 if [ "$failed" -ne 0 ]; then
   exit 1
 fi

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -87,21 +87,6 @@ jobs:
       - name: Build
         if: ${{ !cancelled() }}
         run: pnpm run build
-      - name: Dependency audit
-        if: ${{ !cancelled() }}
-        # Fails on a real high/critical advisory, but treats a broken audit
-        # registry as INCONCLUSIVE rather than reddening a required check for an
-        # infrastructure hiccup (#591, #743). The raw `pnpm audit
-        # --audit-level=high` this replaces exits non-zero identically whether it
-        # found a vulnerability or simply could not parse the registry's
-        # response, so any npm blip failed this job on every open PR at once.
-        #
-        # The relative path is deliberate. This job's working-directory is
-        # apps/frontend, which is exactly the tree to audit, and the script
-        # audits its own cwd — it is byte-identical to biffo-template's copy and
-        # to every other satellite's, distributed by that repo's shared-sync.sh,
-        # so it cannot assume a layout. Do not edit it here; edit it upstream.
-        run: sh ../../scripts/js-dependency-audit.sh
       # The generic relocation of tabsii-platform#377 Phase 2's scale-guard --
       # the systemic half of that issue, built in biffo-template so every new
       # sibling (in any Biffo instance) is born with it. Ships as
@@ -170,6 +155,51 @@ jobs:
       - name: E2E tests
         run: pnpm run e2e
 
+  # Split out of the `js` job deliberately (biffo-template#1880): `pnpm
+  # audit`'s registry call has been chronically, intermittently unreachable
+  # since npm/GitHub retired the legacy audit endpoints on 2026-07-15, an
+  # ongoing upstream infrastructure condition unrelated to this repo's own
+  # code. Mirrors biffo-template's own root `ci.yml` split; see that repo's
+  # `js-audit` job and #1880 for the full evidence. `js` (required) no
+  # longer runs this step, so a registry hang can never again block this
+  # required check; this job runs the exact same script informationally on
+  # every push/PR (`continue-on-error: true`) and is deliberately NOT part
+  # of DEFAULT_STATUS_CHECKS/SIBLING_STATUS_CHECKS.
+  js-audit:
+    name: JS Dependency Audit (non-blocking, #1880)
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    continue-on-error: true
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: apps/frontend/pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
+      - name: Dependency audit
+        if: ${{ !cancelled() }}
+        # Fails on a real high/critical advisory, but treats a broken audit
+        # registry (non-JSON response, or the chronic #1880 timeout) as
+        # INCONCLUSIVE rather than blocking (#591, #743) — and this job's own
+        # non-required status is what stops that inconclusive result from
+        # blocking the merge queue in the first place.
+        #
+        # The relative path is deliberate. This job's working-directory is
+        # apps/frontend, which is exactly the tree to audit, and the script
+        # audits its own cwd — it is byte-identical to biffo-template's copy
+        # and to every other satellite's, distributed by that repo's
+        # shared-sync.sh, so it cannot assume a layout. Do not edit it here;
+        # edit it upstream.
+        run: sh ../../scripts/js-dependency-audit.sh
+
   python:
     name: Python (lint, types, test, security)
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}

package/_skeletons/sibling-template/scripts/js-dependency-audit.sh

@@ -80,12 +80,29 @@ attempts=3
 inconclusive=0
 failed=0
 
-# Audit one directory. Returns 0 if clean or inconclusive, 1 on a real finding.
-# `$1` is the directory, `$2` a human label, `$3` extra pnpm flags.
+# Audit one directory. Returns 0 if clean or inconclusive, 1 on a real finding,
+# AND writes a one-word verdict (`ok` / `fail` / `inconclusive`) to `$4`.
+#
+# The verdict file exists because this function is invoked backgrounded (`&`,
+# see the audit loop below) so the four (or however many) trees run in
+# parallel rather than paying their registry round-trip one after another
+# (#1874: 4 trees serially cost 15m21s in a real CI run and blew the job's
+# 20-minute cap). A backgrounded call is a forked subshell — every variable it
+# touches, including `inconclusive`/`failed` below, is a copy in that child
+# process and vanishes when it exits. The return code has the same problem: a
+# background job's exit status is only visible via `wait "$pid"`, one pid at a
+# time, which is no simpler than a file and less robust (a killed/never-run
+# job leaves nothing to wait on). So each invocation reports for itself, in
+# writing, and the parent tallies the results after `wait` once every
+# invocation has finished.
+#
+# `$1` is the directory, `$2` a human label, `$3` extra pnpm flags, `$4` the
+# result file this invocation must write its verdict to.
 audit_dir() {
   dir="$1"
   label="$2"
   extra="$3"
+  resultfile="$4"
 
   for attempt in $(seq 1 "$attempts"); do
     # printf, never echo: the CI step runs `sh scripts/...` i.e. dash, whose
@@ -122,12 +139,14 @@ audit_dir() {
       if [ "$((high + crit))" -gt 0 ]; then
         echo "::error::${label}: ${crit} critical + ${high} high advisory(ies) across ${total} package(s); registry answered ${seen_at}."
         printf '%s' "$out" | jq '.advisories // .metadata.vulnerabilities' 2>/dev/null | head -c 4000
+        echo "fail" >"$resultfile"
         return 1
       fi
       # A bare "no advisories" is not falsifiable. State the population, the
       # severities that did NOT block, and when the registry was asked, so a
       # reader can tell a clean tree from a tree nobody looked at properly.
       echo "${label}: 0 critical, 0 high across ${total} package(s) (${mod} moderate, ${low} low — reported, not blocking); registry answered ${seen_at}."
+      echo "ok" >"$resultfile"
       return 0
     fi
 
@@ -137,7 +156,7 @@ audit_dir() {
   done
 
   echo "::error::${label}: audit could not run after ${attempts} attempts (the registry returned a non-JSON/error response). Advisory scanning was NOT performed for this tree, so this is INCONCLUSIVE and BLOCKS — a gate that cannot see its input must not report clean (#1269, #591)."
-  inconclusive=$((inconclusive + 1))
+  echo "inconclusive" >"$resultfile"
   return 0
 }
 
@@ -197,11 +216,31 @@ for lock in $ALL_LOCKS; do
   fi
 done
 
-# Audit each discovered tree. The workspace's own lockfile is audited WITHOUT
-# --ignore-workspace, so pnpm resolves it normally; every other discovered
-# lockfile is a separate, vendored project and needs the flag, or pnpm walks
-# up, finds the workspace, and silently audits THAT instead — reporting clean
-# for a tree it never looked at, which is this exact defect one level down.
+# Audit each discovered tree IN PARALLEL (#1874). Each `audit_dir` call is a
+# real network round-trip, with its own retry/backoff, to registry.npmjs.org
+# — run one after another they cost roughly N x the slowest single tree (a
+# real CI run measured 4 trees / 15m21s, blowing the job's 20-minute cap
+# mid-way through ~9 other required guard steps). Backgrounding them lets the
+# round-trips overlap instead.
+#
+# A one-word-per-tree result file (see `audit_dir` above) is how the parent
+# shell learns each backgrounded verdict back: `$TMP_DIR` is created via
+# `mktemp -d` (collision-safe by construction — no need to hand-roll a `$$`
+# suffix on top of it) and torn down by the EXIT/HUP/INT/TERM trap below
+# whichever way this script leaves.
+#
+# The workspace's own lockfile is audited WITHOUT --ignore-workspace, so pnpm
+# resolves it normally; every other discovered lockfile is a separate,
+# vendored project and needs the flag, or pnpm walks up, finds the workspace,
+# and silently audits THAT instead — reporting clean for a tree it never
+# looked at, which is this exact defect one level down.
+TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/js-dependency-audit.XXXXXX") || {
+  echo "::error::js-dependency-audit: could not create a temp directory for parallel results (mktemp failed)." >&2
+  exit 2
+}
+trap 'rm -rf "$TMP_DIR"' EXIT HUP INT TERM
+
+i=0
 for lock in $ALL_LOCKS; do
   dir=$(dirname "$lock")
   dir_abs=$(cd "$dir" 2>/dev/null && pwd -P)
@@ -210,13 +249,41 @@ for lock in $ALL_LOCKS; do
     "$REPO_ROOT"/*) rel=${dir_abs#"$REPO_ROOT"/} ;;
     *) rel="$dir_abs" ;;
   esac
+  i=$((i + 1))
+  resultfile="$TMP_DIR/result.$i"
   if [ "$dir_abs" = "$WORKSPACE_ABS" ]; then
-    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" || failed=1
+    audit_dir "$dir" "pnpm audit (workspace: ${rel})" "" "$resultfile" &
   else
-    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" || failed=1
+    audit_dir "$dir" "pnpm audit (${rel})" "--ignore-workspace" "$resultfile" &
   fi
 done
 
+# Wait for every backgrounded audit_dir before reading any result file back —
+# reading early would race a tree that is still auditing.
+wait
+
+# Tally the verdicts the backgrounded invocations wrote for themselves. A
+# result file that is missing or unreadable (the subshell was killed before
+# it could write, or never started) fails CLOSED as inconclusive rather than
+# being silently skipped — the same posture as the empty-discovery check
+# above: a tree this run cannot account for is not a clean tree.
+i=0
+for lock in $ALL_LOCKS; do
+  i=$((i + 1))
+  resultfile="$TMP_DIR/result.$i"
+  verdict=$(cat "$resultfile" 2>/dev/null)
+  case "$verdict" in
+    ok) ;;
+    fail) failed=1 ;;
+    inconclusive) inconclusive=$((inconclusive + 1)) ;;
+    *)
+      lock_dir=$(dirname "$lock")
+      echo "::error::js-dependency-audit: no verdict recorded for ${lock_dir} (expected ok/fail/inconclusive in ${resultfile}). Treating as inconclusive."
+      inconclusive=$((inconclusive + 1))
+      ;;
+  esac
+done
+
 if [ "$failed" -ne 0 ]; then
   exit 1
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.301.21",
+  "version": "0.301.23",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",