ci: improve vulnerability scanning — reusable audit action, Trivy for lib, dependency-review gate#303
Merged
gblanc-1a merged 1 commit intoJun 26, 2026
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Introduces a reusable composite action (npm-audit-pr-comment) and wires
up dependency-review-action across all three workflows.
On PRs:
- dependency-review-action posts an inline PR comment listing only newly
introduced vulnerabilities and fails the check if any are found
- npm-audit-pr-comment posts or updates a PR comment with the full list
of pre-existing advisories (informational, never blocks the build)
On push to main: existing npm audit steps unchanged (fail hard).
New composite action:
.github/actions/npm-audit-pr-comment/action.yml
- Accepts working-directory, audit-flags, label inputs
- Parses npm audit --json output and formats a markdown table
- Creates or updates a single comment per label (idempotent via marker)
- No-ops on non-PR events
Workflows updated:
docs.yml — website/, --audit-level=high, fail-on-severity: high
lib-collection-scripts-ci.yml — lib/, --audit-level=high, fail-on-severity: high
vscode-extension-secure-ci.yml — root, --omit=dev --audit-level=moderate,
fail-on-severity: moderate
gblanc-1a
force-pushed
the
feat/vulnerability-ci-improvement
branch
from
408f7c8 to
fc183e8
Compare
mvgadagi
approved these changes
Jun 26, 2026
mvgadagi
left a comment
mvgadagi
left a comment
Contributor
There was a problem hiding this comment.
It LGTM @gblanc-1a 🤟 thanks for contribution, the dependency-review workflow is good move 💂
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Overhaul CI vulnerability scanning across the three package scopes (extension, website, lib) by introducing a consistent, non-blocking audit comment action, a single repo-wide dependency-review gate for newly introduced vulnerabilities, and Trivy SARIF scanning for the
libworkspace.Type of Change
Related Issues
Relates to #301
Changes Made
.github/actions/npm-audit-pr-comment/action.yml: posts (or updates) a PR comment listing pre-existingnpm auditfindings for a given package scope. Informational only — never blocks the build. Uses paginated comment lookup and aMapto deduplicate advisories by URL..github/workflows/dependency-review.yml: single repo-wide gate usingactions/dependency-review-action@v4. Only runs whenpackage.json/package-lock.jsonfiles change; fails on newly introduced vulnerabilities of severity ≥ moderate.docs.yml— replaced the barenpm audit --audit-level=highstep with the newnpm-audit-pr-commentaction (PR-only, non-blocking). Addedpull-requests: writepermission.lib-collection-scripts-ci.yml— removednpm auditstep; added Trivyfsscan of thelib/directory with SARIF upload to the GitHub Security tab. Addedsecurity-events: writepermission.vscode-extension-secure-ci.yml— replacednpm ci --audit+npm auditwith thenpm-audit-pr-commentaction. Addedcontents: readandpull-requests: writepermissions.Testing
Test Coverage
Manual Testing Steps
Tested On
ubuntu-latest)Checklist
Reviewer Guidelines
Please pay special attention to:
npm-audit-pr-commentaction runs only onpull_requestevents — push/merge builds skip it intentionally.dependency-review.ymlis the single gating check for new vulnerabilities; the per-scope audit comments are informational.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0.