ci: Add npm security audit gate to deployment pipelines

[frankbria]

Summary

• Add npm audit --audit-level=critical security check to all deployment paths
• Stops deployments when critical npm vulnerabilities are detected
• Lower-severity warnings display but don't block deployment

Changes

Location	Description
.github/workflows/deploy.yml (staging)	Added audit after npm ci, before build
.github/workflows/deploy.yml (production)	Added audit after npm ci, before build
scripts/deploy-staging.sh	Added audit in Phase 6 after dependency install

Behavior

sequenceDiagram
    participant Deploy as Deployment Script
    participant NPM as npm
    participant Audit as npm audit
    participant Build as npm build
    
    Deploy->>NPM: npm ci (install dependencies)
    NPM-->>Deploy: Dependencies installed
    
    Deploy->>Audit: npm audit --audit-level=critical
    
    alt Critical vulnerabilities found
        Audit-->>Deploy: Exit code 1
        Deploy->>Deploy: Stop deployment ❌
    else No critical vulnerabilities
        Audit-->>Deploy: Exit code 0
        Deploy->>Build: npm run build
        Build-->>Deploy: Build complete
        Deploy->>Deploy: Continue deployment ✅
    end

Loading

Scenario	npm audit Result	Deployment Outcome
No vulnerabilities	Exit 0	Continues to build
Low/Moderate/High vulnerabilities	Exit 0	Continues (displays warnings)
Critical vulnerabilities	Exit 1	Stops immediately

Test plan

• Verify staging deployment workflow passes with current dependencies
• Verify production deployment workflow passes with current dependencies
• Verify local scripts/deploy-staging.sh runs audit step successfully
• (Optional) Test failure case by temporarily adding a package with known critical vulnerability

Summary by CodeRabbit

• Chores
  • Enhanced deployment workflows with automatic security audits to detect critical-level vulnerabilities in dependencies before each build in staging and production environments.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Security audit checks are added to deployment workflows using npm audit --audit-level=critical. The checks execute after npm ci in both staging and production paths within the GitHub Actions workflow and the staging deployment script, failing the step if critical vulnerabilities are detected.

Changes

Cohort / File(s)	Summary
Deployment Security Audits \.github/workflows/deploy\.yml, scripts/deploy-staging\.sh	Added npm audit --audit-level=critical checks post-npm ci in both staging and production deployment paths; audit failures will halt the deployment process if critical vulnerabilities exist

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• feat(ci): Add deployment workflow for staging and production #95: Adds npm audit steps to the same deployment workflow and staging deploy script files, with identical functionality and scope

Poem

🐰 A rabbit hops through pipelines bright,
Security checks keep builds tight,
Audits run before we go,
Critical flaws? We'll say "no no!"
Safe deployments steal the show! 🔐

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main change: adding npm security audit gates to deployment pipelines, which is the core objective of this pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feature/npm-audit-deployment

---

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 468b387 and c3a8030.

📒 Files selected for processing (2)

• .github/workflows/deploy.yml
• scripts/deploy-staging.sh

🧰 Additional context used

🧠 Learnings (4)

📚 Learning: 2026-01-04T06:26:12.870Z

Learnt from: CR
Repo: frankbria/codeframe PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-04T06:26:12.870Z
Learning: For NEXT_PUBLIC_* environment variables, set them BEFORE npm run build (at build time, not runtime) as they are embedded in the JavaScript bundle

Applied to files:

• .github/workflows/deploy.yml

📚 Learning: 2026-01-04T06:26:12.870Z

Learnt from: CR
Repo: frankbria/codeframe PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-04T06:26:12.870Z
Learning: Applies to web-ui/src/lib/**/*.ts : Frontend API files must use const API_BASE_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:8080' pattern without hardcoded production URLs or different fallback ports

Applied to files:

• .github/workflows/deploy.yml

📚 Learning: 2026-01-04T06:26:12.870Z

Learnt from: CR
Repo: frankbria/codeframe PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-04T06:26:12.870Z
Learning: Applies to web-ui/src/**/*.{ts,tsx} : Use TypeScript 5.3+ for frontend development with React 18, Next.js 14, Tailwind CSS, and Hugeicons for icons

Applied to files:

• .github/workflows/deploy.yml

📚 Learning: 2026-01-04T06:26:12.870Z

Learnt from: CR
Repo: frankbria/codeframe PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-01-04T06:26:12.870Z
Learning: Run tests using 'uv run pytest' for Python tests and 'cd web-ui && npm test' for frontend tests

Applied to files:

• .github/workflows/deploy.yml

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

• GitHub Check: Backend Unit Tests
• GitHub Check: Frontend Unit Tests
• GitHub Check: E2E Smoke Tests (Chromium)

🔇 Additional comments (4)

scripts/deploy-staging.sh (1)

139-140: LGTM! Security audit correctly positioned in deployment flow.

The audit executes after dependency installation and before the build phase, which optimally catches critical vulnerabilities before building artifacts. The set -e directive at line 5 ensures deployment stops on critical findings.

.github/workflows/deploy.yml (3)

164-165: LGTM! Staging security audit correctly integrated.

The audit placement after npm ci and before build is optimal. The set -e in the SSH command ensures the deployment halts if critical vulnerabilities are detected.

---

472-473: LGTM! Production security audit correctly integrated.

Consistent with the staging implementation, the audit is properly positioned to catch critical vulnerabilities before the production build proceeds.

---

164-165: The npm audit --audit-level=critical exit code behavior is as expected.

The command correctly exits with code 0 when no critical vulnerabilities are found and exits with non-zero when critical vulnerabilities are detected. Network failures or npm registry downtime will also cause the command to fail, which is expected fail-safe behavior for deployment scripts—teams should be aware that transient registry issues will block deployments.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}