ci: harden dependency audit checks - #990
Conversation
|
Warning Review limit reached
More reviews will be available in 16 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR bumps Bun from 1.3.13 to 1.3.14 across all CI workflows and the package manifest, adds a new ChangesBun 1.3.14 Rollout
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related issues
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
app
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Suggested priority: P2 (includes user-path files (packages/app/src/testing/perf-workflow.test.ts)).
P1/P0 are reserved for maintainer confirmation. Please relabel manually if this is a release blocker, security issue, data-loss risk, or updater/runtime failure.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Bun package manager version to 1.3.14 across the repository, updates workflow tests to reflect this change, and introduces new contract tests to validate GitHub workflows, including Bun version pinning and dependency reviews. Feedback suggests enhancing the Bun version pinning test to ensure that every workflow step utilizing oven-sh/setup-bun explicitly defines a bun-version pin, preventing potential configuration drift if a pin is omitted in future workflows.
Root cause: - The dev `windows-advisory` run after PR #990 exposed Windows-only path separator assertions in the Bun version workflow contract. - Windows opencode shard args used prefix-sensitive paths such as `test/git`, `test/file`, and `test/share`, which can also match sibling directories. - A session retry test coupled disabled-tool retry semantics to a 20ms live HTTP timing window, and PR CI exposed a fake-time fixture where `completedAt` could be earlier than `triggeredAt`. Changes: - Normalize workflow contract paths before comparing setup-bun pins. - Use trailing-slash shard args for prefix-sensitive Windows opencode test directories and add a generic contract guard for ambiguous shard paths. - Add deterministic disabled-tool boundary/retry coverage and relax the live retry timeout to reduce Windows runner timing sensitivity. - Align the global session activity test fake clock with the synthetic reminder timestamp. Verification: - `cd packages/opencode && bun test test/github/bun-version-workflow.test.ts test/github/ci-workflow.test.ts` -> 16 pass, 0 fail. - `cd packages/opencode && bun test test/session/run-observability.test.ts` -> 67 pass, 0 fail. - `cd packages/opencode && bun test test/session/run-observability.test.ts test/session/processor-effect.test.ts -t "disabled unknown tools"` -> 2 pass, 0 fail. - `cd packages/opencode && bun test test/server/global-session-activity-list.test.ts` -> 6 pass, 0 fail. - PR CI required checks passed after follow-up commit; `dev-dep-audit` remains a known non-gating advisory signal from existing dependency advisories. Review follow-up: - Addressed and resolved Gemini Code Assist feedback about `test/git/` and `test/file/`, and extended the same guard to `test/share/`. Residual risk: - Windows advisory itself runs on dev push, so final proof is the post-merge `windows-advisory` run on `dev`.
1 participant
Summary
Harden the second #977 CI slice: remove the now-unused perf Playwright browser cache, tighten dependency-review, add a non-required Bun audit visibility check, and pin workflow Bun runtimes to the audit-verified
1.3.14.Why
PR #988 moved
perf-probe-baselineto system Chrome with Playwright video disabled, leaving the.playwright-browsersrestore cache unused. The dependency review workflow was still advisory-only and its job name did not match the planned required context.bun auditis useful signal, but currentdevalready has high/critical advisories, so this PR adds it as a visible non-required check rather than a merge gate.Related Issue
Closes part of #977.
Human Review Status
Pending
Review Focus
Please focus on the GitHub Actions semantics:
dependency-reviewnow emits the required check name,dev-dep-auditis intentionally not a required context, and everysetup-bunworkflow pin is on1.3.14with a contract test covering the scan.Risk Notes
dev-dep-auditcurrently fails on the existing lockfile advisories:34 vulnerabilities (1 critical, 33 high). It is intentionally a non-required visibility check until those are fixed or baselined.dev-dep-audittodev-merge-gatefrom this PR. It would block unrelated PRs.dependency-reviewcan become required after this workflow shape lands ondev, because the job now emits thedependency-reviewcheck name.How To Verify
Screenshots or Recordings
Not applicable. No visible UI changes.
Checklist
bug,enhancement,task,documentation. Type labels are author-added; the labeler bot does NOT assign them. Add the label in the GitHub UI, then tick this.app,ui,platform,harness,ci. The labeler bot assigns these on PR open based on changed paths. Confirm the bot's choice (or override if wrong), then tick this.P0,P1,P2,P3. The priority-triage bot suggests one on PR open. Confirm or override, then tick this.Pending,Approved by @<reviewer>, orNot required: <reason>(default isPending; "not required" is restricted to bot-authored low-risk PRs).dev, and my PR title and commit messages use Conventional Commits in English.Summary by CodeRabbit
Chores
New Features
Bug Fixes
Tests