@biffo/cli 0.301.22 → 0.301.24

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -87,21 +87,6 @@ jobs:
       - name: Build
         if: ${{ !cancelled() }}
         run: pnpm run build
-      - name: Dependency audit
-        if: ${{ !cancelled() }}
-        # Fails on a real high/critical advisory, but treats a broken audit
-        # registry as INCONCLUSIVE rather than reddening a required check for an
-        # infrastructure hiccup (#591, #743). The raw `pnpm audit
-        # --audit-level=high` this replaces exits non-zero identically whether it
-        # found a vulnerability or simply could not parse the registry's
-        # response, so any npm blip failed this job on every open PR at once.
-        #
-        # The relative path is deliberate. This job's working-directory is
-        # apps/frontend, which is exactly the tree to audit, and the script
-        # audits its own cwd — it is byte-identical to biffo-template's copy and
-        # to every other satellite's, distributed by that repo's shared-sync.sh,
-        # so it cannot assume a layout. Do not edit it here; edit it upstream.
-        run: sh ../../scripts/js-dependency-audit.sh
       # The generic relocation of tabsii-platform#377 Phase 2's scale-guard --
       # the systemic half of that issue, built in biffo-template so every new
       # sibling (in any Biffo instance) is born with it. Ships as
@@ -170,6 +155,51 @@ jobs:
       - name: E2E tests
         run: pnpm run e2e
 
+  # Split out of the `js` job deliberately (biffo-template#1880): `pnpm
+  # audit`'s registry call has been chronically, intermittently unreachable
+  # since npm/GitHub retired the legacy audit endpoints on 2026-07-15, an
+  # ongoing upstream infrastructure condition unrelated to this repo's own
+  # code. Mirrors biffo-template's own root `ci.yml` split; see that repo's
+  # `js-audit` job and #1880 for the full evidence. `js` (required) no
+  # longer runs this step, so a registry hang can never again block this
+  # required check; this job runs the exact same script informationally on
+  # every push/PR (`continue-on-error: true`) and is deliberately NOT part
+  # of DEFAULT_STATUS_CHECKS/SIBLING_STATUS_CHECKS.
+  js-audit:
+    name: JS Dependency Audit (non-blocking, #1880)
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    continue-on-error: true
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: apps/frontend/pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
+      - name: Dependency audit
+        if: ${{ !cancelled() }}
+        # Fails on a real high/critical advisory, but treats a broken audit
+        # registry (non-JSON response, or the chronic #1880 timeout) as
+        # INCONCLUSIVE rather than blocking (#591, #743) — and this job's own
+        # non-required status is what stops that inconclusive result from
+        # blocking the merge queue in the first place.
+        #
+        # The relative path is deliberate. This job's working-directory is
+        # apps/frontend, which is exactly the tree to audit, and the script
+        # audits its own cwd — it is byte-identical to biffo-template's copy
+        # and to every other satellite's, distributed by that repo's
+        # shared-sync.sh, so it cannot assume a layout. Do not edit it here;
+        # edit it upstream.
+        run: sh ../../scripts/js-dependency-audit.sh
+
   python:
     name: Python (lint, types, test, security)
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
@@ -178,16 +208,14 @@ jobs:
       run:
         working-directory: services/api
     steps:
-      # `fetch-depth: 0` matches the root repo's own `python` job (#1692) and is
-      # required by the Dependency audit step below: py-dependency-audit.sh's
-      # pre-existing-vs-introduced comparison (#1673) only activates when
-      # `origin/${GITHUB_BASE_REF}` resolves locally, which a shallow (depth-1,
-      # single-ref) checkout never provides. Without this, every finding blocks,
-      # identical to pre-#1673 behaviour, on every repo scaffolded from this
-      # skeleton (biffo-template#1803).
+      # `fetch-depth: 0` is no longer required here (#1882): it existed
+      # solely for py-dependency-audit.sh's pre-existing-vs-introduced
+      # comparison (#1673), which needed `origin/${GITHUB_BASE_REF}` to
+      # resolve locally -- that step, and the same full-depth checkout it
+      # needs, moved to the `python-audit` job below when the audit was
+      # split out of this required job. Nothing remaining in this job reads
+      # `origin/` state, so the default shallow checkout is correct here now.
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          fetch-depth: 0
       - uses: astral-sh/setup-uv@v5
         with:
           enable-cache: true
@@ -248,13 +276,6 @@ jobs:
         with:
           name: bandit-report
           path: services/api/bandit-report.json
-      - name: Dependency audit
-        if: ${{ !cancelled() }}
-        # Same treatment as the JS job's Dependency audit above: fails on a real
-        # advisory, INCONCLUSIVE on an unreachable PyPI/OSV (#591, #743). cwd is
-        # services/api, which is the environment `uv sync` installed and so the
-        # one to audit.
-        run: sh ../../scripts/py-dependency-audit.sh
       - name: Routing smoke test — self-test
         if: ${{ !cancelled() }}
         # Not exercising this repo's own deployment (CI has none to reach) —
@@ -340,6 +361,39 @@ jobs:
           fi
           echo "PASS: every scripts/*.test.sh guard in this repo has a caller."
 
+  # Split out of the `python` job deliberately (biffo-template#1882, mirroring
+  # #1880/#1881's identical JS-side fix): `pip-audit`'s advisory lookups are
+  # exactly as registry-dependent and chronically unreliable as `pnpm audit`'s
+  # were. `python` (required) no longer runs this step, so a registry-side
+  # advisory event can never again block that job; this job runs the exact
+  # same script informationally on every push/PR (`continue-on-error: true`)
+  # and is deliberately NOT part of DEFAULT_STATUS_CHECKS/SIBLING_STATUS_CHECKS.
+  python-audit:
+    name: Python Dependency Audit (non-blocking, #1882)
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    continue-on-error: true
+    defaults:
+      run:
+        working-directory: services/api
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - run: uv sync --all-groups --locked
+      - name: Dependency audit
+        if: ${{ !cancelled() }}
+        # Same treatment as the JS job's Dependency audit: fails on a real
+        # advisory, INCONCLUSIVE on an unreachable PyPI/OSV (#591, #743) —
+        # and this job's own non-required status is what stops that
+        # inconclusive result from blocking the merge queue in the first
+        # place. cwd is services/api, which is the environment `uv sync`
+        # installed and so the one to audit.
+        run: sh ../../scripts/py-dependency-audit.sh
+
   security-secrets:
     name: Secret Scan
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.301.22",
+  "version": "0.301.24",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",