build: audit-exception expiry release gate#827
Merged
Conversation
Add a focused, offline release-hygiene gate over the dependency audit allowlist (security/audit-allowlist.json). scripts/check-audit-exception- expiry.mjs reuses parseAllowlist() from audit-gate-lib.mjs to report the allowlist's expiry and renewal-review health without running pnpm audit: RED on expired or invalid entries, YELLOW on entries expiring within the 14-day window or added more than 30 days ago without a reviewed_at date, GREEN otherwise. --strict passes through to parseAllowlist (entries past the 60-day review window without review are rejected) and fails on YELLOW; --json emits the result. The classification is a pure, exported helper behind a main guard so it unit-tests deterministically with a fixed date. Document the gate in the release Pre-Release Checklist and the step 4 gate list, and record the npm-token-age, OIDC plus SLSA provenance, and SSH-signed annotated tag expectations in docs/RELEASING.md.
Make the gate truly release-blocking and add deterministic CLI coverage: - docs/RELEASING.md now runs the check in --strict release mode in both the Pre-Release Checklist and the step 4 gate list, so a YELLOW (expiring-soon or review-stale) exception fails release prep instead of passing silently. - The script gains --allowlist <path> (default security/audit-allowlist.json; relative paths resolve from the working directory; a missing value exits 2) so the CLI can be exercised against fixtures without touching the live allowlist. - The test adds CLI smoke tests over synthetic allowlists (healthy GREEN JSON, warning YELLOW, warning under --strict exits 1, missing --allowlist value exits 2, unknown argument exits 2, and a main-guard probe that import does not run the CLI).
jithinraj
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a focused, offline release-hygiene gate over the dependency audit allowlist so no audit exception silently expires or goes past its renewal-review window across a release. No protocol surface change.
Scope
Tooling, its test, and release docs only. No wire, schema, signing, CLI, or runtime behavior change; no published-package change; no workflow change; no dependency change. The audit allowlist data (
security/audit-allowlist.json) is not modified. Public-surface sentinels are unchanged.