ci: restore static and unit baseline gates (#3219)

Patrick-Erichsen · web-flow · commit a9775fc39b10 · 2026-07-21T22:19:53.000-07:00
* test: use valid artifact fixture hashes

* chore(deps): override newly vulnerable transitive packages
diff --git a/bun.lock b/bun.lock
diff --git a/package.json b/package.json
@@ -181,11 +181,13 @@
   "overrides": {
     "ast-v8-to-istanbul": "1.0.4",
     "brace-expansion": "5.0.7",
-    "dompurify": "3.4.11",
+    "dompurify": "3.4.12",
     "esbuild": "0.28.1",
+    "fast-uri": "3.1.4",
     "js-yaml": "4.3.0",
     "next": "16.2.6",
     "postcss": "8.5.12",
+    "sharp": "0.35.3",
     "shell-quote": "1.10.0",
     "undici": "7.28.0",
     "ws": "8.21.0"
diff --git a/scripts/security/run-codex-scan-worker.test.ts b/scripts/security/run-codex-scan-worker.test.ts
@@ -464,19 +464,19 @@ describe("run-codex-scan-worker diagnostics", () => {
           files: [
             {
               path: "scripts",
-              sha256: "empty",
+              sha256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
               size: 0,
               url: "data:application/octet-stream,",
             },
             {
               path: "scripts/run.sh",
-              sha256: "script",
+              sha256: "277cfe839808c4010d970694be37f2a28cc592396a68d8868b85c8303497319b",
               size: 18,
               url: "data:text/plain,echo%20ready%0A",
             },
             {
               path: "EMPTY",
-              sha256: "empty",
+              sha256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
               size: 0,
               url: "data:application/octet-stream,",
             },
