feat(ops): fortnightly dependency report cron (disabled, report-only)#618
Conversation
Tier D. Surfaces dependency drift + vulnerabilities proactively without unsafe auto-updates (this repo's `dependency` maintenance is a careful, judgment-heavy protocol per AGENTS.md, never an unattended bulk-bump). - scripts/dependency-report.mjs: renders `npm outdated --json` + `npm audit --json` into a Markdown digest — direct-dep table (current→wanted→latest, major-bump flags) + vuln counts by severity. Always exits 0 (findings are normal, not a failure). `--input` reads captured JSON for offline/test runs. Pure renderer + highestSeverity exported. - .github/workflows/dependency-report.yml: SHIPPED DISABLED (dispatch-only, schedule commented). Posts to a rolling "dependency-report" issue; comments only on high/critical vulns. Pinned actions, least-privilege. - deps:report npm script; tests/dependency-report.test.ts (4 tests). Verified: 4/4 vitest, mock-input smoke, check:github-actions, eslint, tsc (own files clean), prettier. No auto-update; reads only npm registry metadata. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughAdds a dependency report CLI, unit tests, an npm script, and a manually triggered GitHub Actions workflow that generates reports and updates or creates a labeled issue with severity warnings. ChangesDependency reporting
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant dependency-report.mjs
participant GitHubIssues
GitHubActions->>dependency-report.mjs: Generate dependency-report.md
dependency-report.mjs-->>GitHubActions: Return outdated count and severity
GitHubActions->>GitHubIssues: Update or create dependency-report issue
GitHubActions->>GitHubIssues: Add warning comment for high or critical severity
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 105d622432
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 105d622432
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependency-report.yml:
- Around line 54-55: Update the workflow step containing the inline JavaScript
to pass the report outputs through the step-level env configuration, then read
them from process.env instead of embedding steps.report.outputs.outdated or
severity in JavaScript string literals. Keep the existing numeric default for
outdated and "none" default for severity, and ensure env is nested at the step
level rather than under with.
- Around line 28-49: Replace the mutable major-version references for Checkout,
Setup Node.js, and Publish to rolling issue with their trusted immutable commit
SHAs, retaining an inline comment identifying each pinned action version. Do not
change the workflow steps or permissions.
In `@scripts/dependency-report.mjs`:
- Around line 30-44: Update runNpmJson to capture stderr and retain enough
execution-error context to distinguish npm failures from valid non-zero results;
emit a warning when the command fails or produces non-JSON output while
preserving the script’s always-exit-0 behavior. Adjust parseJsonSafe to warn
before returning its fallback for non-empty invalid JSON, without changing valid
JSON or empty-output handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 63ba7be0-6e0a-4385-82f3-869311460a27
📒 Files selected for processing (4)
.github/workflows/dependency-report.ymlpackage.jsonscripts/dependency-report.mjstests/dependency-report.test.ts
Codex P2 (PR #621): the tooling entry referenced `deps:report` + a dependency-report workflow, but those live in the still-open #618, not on main — a reader would assume dependency reporting is installed. Removed the forward-reference; the entry now documents only tooling that has landed. #618 can add its own line when it merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…out state (#621) * docs(process-hardening): consolidate repo-productivity tooling + rollout state Tier D (memory consolidation). Promotes the durable knowledge about the repo-productivity program's tooling out of session/chat memory into the shared repo record, so future contributors and agents discover the guards, the disabled/warn-only automation, and how to enable each piece — without relying on private memory. Adds a dated "Repo-productivity & automation tooling (2026-07-13)" entry: pre-push guards + installer, stale-base tripwire, spend/ops-digest/ingestion-autopilot/ ci-triage (with enablement state), env-parity + branch sweeper, session skills, and the bundle-budget / docs:check-scripts / deps:report CI guards. operator-backlog.md remains the index of human-only enablement steps. Verified: docs:check-links (774 paths) and docs:check-scripts (263 refs) both pass; prettier clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: drop deps:report forward-reference (not on main yet) Codex P2 (PR #621): the tooling entry referenced `deps:report` + a dependency-report workflow, but those live in the still-open #618, not on main — a reader would assume dependency reporting is installed. Removed the forward-reference; the entry now documents only tooling that has landed. #618 can add its own line when it merges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…ection-safe outputs PR #618 review fixes: - Detect npm error payloads: a failed `npm outdated --json` can emit { error: … } on stdout; now treated as "data unavailable" (renders null, not a bogus package count). (Codex) - Surface silent failures: runNpmJson captures stderr and parseJsonSafe warns on non-JSON, so a network/registry failure shows in logs instead of a falsely-clean "none 🎉". (CodeRabbit) - Include dev dependencies in audit (drop --omit=dev): the dependency-maintenance protocol covers the dev toolchain; prod high/critical is already gated by the CI safety job. (Codex) - Pass step outputs to github-script via env: instead of inline template expansion (avoids the Actions template-injection pattern). (CodeRabbit) Declined: SHA-pinning first-party actions/* — the repo's check:github-actions deliberately permits vetted major-version tags for first-party actions, and the sibling ops-digest/ci-triage/ingestion-autopilot workflows use the same form; pinning only this one would be inconsistent. The gate still passes. Verified: 5/5 vitest (incl. new data-unavailable case), error-payload smoke, check:github-actions, eslint, tsc, prettier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
# Conflicts: # package.json
1 participant
What
Tier D. Surfaces dependency drift + vulnerabilities proactively — without unsafe auto-updates (this repo's
dependencymaintenance is a careful, judgment-heavy protocol per AGENTS.md, never an unattended bulk-bump).scripts/dependency-report.mjs— rendersnpm outdated --json+npm audit --jsoninto a Markdown digest: direct-dep table (current→wanted→latest, major-bump flags) + vuln counts by severity. Always exits 0 (findings are normal, not a failure).--inputreads captured JSON for offline/test runs. PurerenderDependencyReport+highestSeverityexported..github/workflows/dependency-report.yml— SHIPPED DISABLED (dispatch-only; schedule commented). Posts to a rollingdependency-reportissue; comments (notifies) only on high/critical vulns. Pinned actions, least-privilege.deps:reportnpm script;tests/dependency-report.test.ts(4 tests).Enabling (operator)
Uncomment the
schedule:block and run oneworkflow_dispatchto confirm the issue.Verification
4/4 vitest, mock-input smoke,
check:github-actions, eslint,tsc(own files clean), prettier. Reads only npm registry metadata; never updates deps.🤖 Generated with Claude Code
Summary by CodeRabbit