@mnci/cli 1.19.2 → 1.19.3

package/dist/cli.js

@@ -1763,7 +1763,7 @@ var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:
 var FLUTTER_TOOL_PATH_AZURE = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
 var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
 var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
-var NPM_AUDIT_STEP = "npm audit --audit-level=high || echo npm audit found vulnerabilities, see log above - non-blocking, run npm audit locally to inspect";
+var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(v.fixAvailable?' - fix available, below the blocking threshold':' - NO fix available upstream, nothing to do here'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available'+(v.fixAvailable&&v.fixAvailable.isSemVerMajor?' (semver-major)':''));console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
 var VERIFY_TARGETS = "lint,typecheck,test,build";
 var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});if(fs.globSync('apps/*/project.json').length===0){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
@@ -1866,11 +1866,11 @@ steps:
     env:
       ${npmAuthName}: ${npmAuthValue}
 
-  # Non-blocking: surfaces known-vulnerable dependencies in every CI log
-  # without failing the build over an upstream-only advisory nobody here can
-  # fix (see NPM_AUDIT_STEP's remarks in overlay.ts for why).
+  # Fails ONLY on an advisory that has a published fix, at moderate or above;
+  # anything upstream has not fixed is printed and passes. See NPM_AUDIT_STEP's
+  # remarks for why that split replaced a warn-only step.
   - script: ${NPM_AUDIT_STEP}
-    displayName: npm audit (non-blocking)
+    displayName: npm audit (fails on an actionable advisory)
 
   # Installs the fixed Python toolchain (ruff, pytest, build, twine, pip-audit)
   # \u2014 written by 'mnci add' to requirements-dev.txt on the first Python
@@ -2066,11 +2066,11 @@ jobs:
         env:
           ${npmAuthName}: ${npmAuthValue}
 
-      # Non-blocking: surfaces known-vulnerable dependencies in every CI log
-      # without failing the build over an upstream-only advisory nobody here
-      # can fix (see NPM_AUDIT_STEP's remarks in overlay.ts for why).
+      # Fails ONLY on an advisory that has a published fix, at moderate or
+      # above; anything upstream has not fixed is printed and passes. See
+      # NPM_AUDIT_STEP's remarks for why that split replaced a warn-only step.
       - run: ${NPM_AUDIT_STEP}
-        name: npm audit (non-blocking)
+        name: npm audit (fails on an actionable advisory)
 
       # Installs the fixed Python toolchain (ruff, pytest, build, twine,
       # pip-audit) \u2014 written by 'mnci add' to requirements-dev.txt on the