fix(auth)!: second-pass audit + post-fix review (iss bypass + 15 review findings) #139
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for secrets | |
| env: | |
| # Bump together; checksum from | |
| # https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt | |
| GITLEAKS_VERSION: 8.30.1 | |
| GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz | |
| echo "${GITLEAKS_SHA256} /tmp/gitleaks.tgz" | sha256sum -c - | |
| tar xz -C /tmp -f /tmp/gitleaks.tgz | |
| /tmp/gitleaks detect --source . --verbose --redact | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: 'npm' | |
| - name: Check for large files | |
| run: | | |
| LARGE=$(find . -not -path './.git/*' -not -path './node_modules/*' -type f -size +5M) | |
| if [ -n "$LARGE" ]; then | |
| echo "::error::Large files detected (>5 MB):" | |
| echo "$LARGE" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| - name: Check licenses | |
| run: npx license-checker --failOn "GPL-2.0;GPL-3.0;AGPL-3.0" | |
| - name: Security audit | |
| # Threshold raised from `critical` to `high` in the 2026-05-21 | |
| # second-pass audit. The previous `critical`-only gate masked | |
| # 20+ high-severity production advisories (undici, tar, node-forge, | |
| # @xmldom/xmldom, postcss, picomatch, brace-expansion, fast-uri). | |
| # The fix path for all of them is the Expo SDK 52 to 55 upgrade | |
| # tracked in the modernization audit — failing CI here is the | |
| # forcing function for that upgrade. | |
| # | |
| # CD / maintenance impact (called out by the post-fix code review): | |
| # cd-android.yml, cd-ios.yml, and maintenance.yml all reuse this | |
| # workflow via `uses` plus `needs: ci`. While the SDK upgrade is | |
| # outstanding, any workflow_dispatch of the CD pipelines and every | |
| # Monday scheduled maintenance run will also fail at this step. | |
| # That is intentional — releasing on top of a known-vulnerable | |
| # transitive tree is exactly what this gate is meant to prevent — | |
| # but contributors should know not to treat the red badge as new | |
| # breakage. | |
| # | |
| # If a single transitive advisory genuinely can't be patched, | |
| # document the exception inline rather than weakening this gate. | |
| run: npm audit --audit-level=high | |
| - name: Lint | |
| run: npm run lint | |
| - name: Test | |
| run: npm test | |
| # Web export is a non-goal for the starter (README "Non-Goals"). The | |
| # previous `2>/dev/null || echo "skipping"` swallowed real build | |
| # failures, so the step was producing a false-green signal. Removed | |
| # entirely — `npm test` is the build verification for this project. |