[P1] Add npm audit review during deployment script

[frankbria]

Before building the web-ui frontend, run a npm audit on web-ui. If there are any critical findings, exit with code 1 to stop the process immediately.

[traycerai]

Plan

Observations

The codebase has multiple deployment paths: GitHub Actions workflows for staging/production deployments (file:.github/workflows/deploy.yml) and a local deployment script (file:scripts/deploy-staging.sh). Both paths install dependencies with npm ci and build the web-ui with npm run build. Currently, there's no security audit step before building, which leaves the deployment vulnerable to critical npm package vulnerabilities.

Approach

Add npm audit --audit-level=critical immediately after npm ci and before npm run build in all deployment scripts. This command will automatically exit with code 1 if critical vulnerabilities are detected, stopping the deployment process. The --audit-level=critical flag ensures only critical findings trigger failure, while still displaying all vulnerability information for awareness.

Implementation Steps

1. Update GitHub Actions Staging Deployment

In file:.github/workflows/deploy.yml, modify the staging deployment section:

Location: Lines 156-160 in the "Deploy to staging server" step

Add the npm audit command after npm ci and before npm run build:

# Frontend setup
echo "📦 Building frontend..."
cd web-ui
npm ci
npm audit --audit-level=critical
npm run build
cd ..

The audit command will:

• Run security audit on installed packages
• Exit with code 1 if critical vulnerabilities exist
• Stop the deployment immediately due to set -e flag
• Display all vulnerabilities for review

2. Update GitHub Actions Production Deployment

In file:.github/workflows/deploy.yml, modify the production deployment section:

Location: Lines 454-458 in the "Deploy to production server" step

Add the same npm audit command:

# Frontend setup (production build)
echo "📦 Building frontend for production..."
cd web-ui
npm ci
npm audit --audit-level=critical
npm run build
cd ..

This ensures production deployments have the same security gate as staging.

3. Update Local Staging Deployment Script

In file:scripts/deploy-staging.sh, add the audit step in the build phase:

Location: Between Phase 6 (lines 136-140) and Phase 7 (lines 148-151)

Insert a new phase or add to Phase 6:

cd web-ui
echo "Installing Node.js dependencies (this may take a minute)..."
npm ci --production=false
echo "Running security audit..."
npm audit --audit-level=critical
cd ..

Then Phase 7 remains unchanged with the build step.

Alternatively, add it directly in Phase 7 before the build:

# PHASE 7: BUILD FRONTEND FOR PRODUCTION
echo ""
echo -e "${BLUE}[7/10] Building Frontend for Production${NC}"

cd web-ui
echo "Running security audit..."
npm audit --audit-level=critical
echo "Building Next.js application (this may take a minute)..."
npm run build
cd ..
echo -e "${GREEN}✓ Frontend built successfully${NC}"

Deployment Flow Diagram

sequenceDiagram
    participant Deploy as Deployment Script
    participant NPM as npm
    participant Audit as npm audit
    participant Build as npm build
    
    Deploy->>NPM: npm ci (install dependencies)
    NPM-->>Deploy: Dependencies installed
    
    Deploy->>Audit: npm audit --audit-level=critical
    
    alt Critical vulnerabilities found
        Audit-->>Deploy: Exit code 1
        Deploy->>Deploy: Stop deployment ❌
    else No critical vulnerabilities
        Audit-->>Deploy: Exit code 0
        Deploy->>Build: npm run build
        Build-->>Deploy: Build complete
        Deploy->>Deploy: Continue deployment ✅
    end

Loading

Expected Behavior

Scenario	npm audit Result	Deployment Outcome
No vulnerabilities	Exit 0	Continues to build
Low/Moderate/High vulnerabilities	Exit 0	Continues to build (displays warnings)
Critical vulnerabilities	Exit 1	Stops immediately, no build

Files to Modify

1. file:.github/workflows/deploy.yml (2 locations: staging and production)
2. file:scripts/deploy-staging.sh (1 location: before build phase)

Import In IDE

🤖 Prompt for AI Agents

## Observations

The codebase has multiple deployment paths: GitHub Actions workflows for staging/production deployments (file:.github/workflows/deploy.yml) and a local deployment script (file:scripts/deploy-staging.sh). Both paths install dependencies with `npm ci` and build the web-ui with `npm run build`. Currently, there's no security audit step before building, which leaves the deployment vulnerable to critical npm package vulnerabilities.

## Approach

Add `npm audit --audit-level=critical` immediately after `npm ci` and before `npm run build` in all deployment scripts. This command will automatically exit with code 1 if critical vulnerabilities are detected, stopping the deployment process. The `--audit-level=critical` flag ensures only critical findings trigger failure, while still displaying all vulnerability information for awareness.

## Implementation Steps

### 1. Update GitHub Actions Staging Deployment

In file:.github/workflows/deploy.yml, modify the staging deployment section:

**Location**: Lines 156-160 in the "Deploy to staging server" step

Add the npm audit command after `npm ci` and before `npm run build`:

```bash
# Frontend setup
echo "📦 Building frontend..."
cd web-ui
npm ci
npm audit --audit-level=critical
npm run build
cd ..
```

The audit command will:
- Run security audit on installed packages
- Exit with code 1 if critical vulnerabilities exist
- Stop the deployment immediately due to `set -e` flag
- Display all vulnerabilities for review

### 2. Update GitHub Actions Production Deployment

In file:.github/workflows/deploy.yml, modify the production deployment section:

**Location**: Lines 454-458 in the "Deploy to production server" step

Add the same npm audit command:

```bash
# Frontend setup (production build)
echo "📦 Building frontend for production..."
cd web-ui
npm ci
npm audit --audit-level=critical
npm run build
cd ..
```

This ensures production deployments have the same security gate as staging.

### 3. Update Local Staging Deployment Script

In file:scripts/deploy-staging.sh, add the audit step in the build phase:

**Location**: Between Phase 6 (lines 136-140) and Phase 7 (lines 148-151)

Insert a new phase or add to Phase 6:

```bash
cd web-ui
echo "Installing Node.js dependencies (this may take a minute)..."
npm ci --production=false
echo "Running security audit..."
npm audit --audit-level=critical
cd ..
```

Then Phase 7 remains unchanged with the build step.

Alternatively, add it directly in Phase 7 before the build:

```bash
# PHASE 7: BUILD FRONTEND FOR PRODUCTION
echo ""
echo -e "${BLUE}[7/10] Building Frontend for Production${NC}"

cd web-ui
echo "Running security audit..."
npm audit --audit-level=critical
echo "Building Next.js application (this may take a minute)..."
npm run build
cd ..
echo -e "${GREEN}✓ Frontend built successfully${NC}"
```

## Deployment Flow Diagram

```mermaid
sequenceDiagram
    participant Deploy as Deployment Script
    participant NPM as npm
    participant Audit as npm audit
    participant Build as npm build
    
    Deploy->>NPM: npm ci (install dependencies)
    NPM-->>Deploy: Dependencies installed
    
    Deploy->>Audit: npm audit --audit-level=critical
    
    alt Critical vulnerabilities found
        Audit-->>Deploy: Exit code 1
        Deploy->>Deploy: Stop deployment ❌
    else No critical vulnerabilities
        Audit-->>Deploy: Exit code 0
        Deploy->>Build: npm run build
        Build-->>Deploy: Build complete
        Deploy->>Deploy: Continue deployment ✅
    end
```

## Expected Behavior

| Scenario | npm audit Result | Deployment Outcome |
|----------|------------------|-------------------|
| No vulnerabilities | Exit 0 | Continues to build |
| Low/Moderate/High vulnerabilities | Exit 0 | Continues to build (displays warnings) |
| Critical vulnerabilities | Exit 1 | Stops immediately, no build |

## Files to Modify

1. file:.github/workflows/deploy.yml (2 locations: staging and production)
2. file:scripts/deploy-staging.sh (1 location: before build phase)

---

Execution Information

Branch: main
Commit: 2b15c8f

---

💡 Tips

Supported Commands (Inside Comments)

• Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

• Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
• Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.