The commit that fixed my only security advisory failed its security audit. The audit never ran.

Description and use

In the CI workflow, npm audit incorrectly flagged a service outage as a vulnerability, causing a false red status and release without proper gating. A retry mechanism and disabling fail-fast were added so each Node version reports results accurately.

Problem

CI security audit failed due to external service outage, causing false red CI status and release without proper gate.

Outcome

CI now distinguishes between real vulnerabilities and transient service outages, reducing false positives and ensuring releases are gated by actual security status.

Workflow

• 1. Merge Dependabot PRs before cutting release tags.
• 2. Configure CI matrix with strategy.fail-fast:false.
• 3. Run npm audit with retry loop: attempt up to 3 times, retry after 30s if audit endpoint error.
• 4. Exit 0 on successful audit, exit 1 on real vulnerability or after retries.
• 5. Publish release after CI passes for all matrix jobs.

Evidence

The audit endpoint was unreachable, npm audit exited non-zero, the step failed, and because the matrix has fail-fast on by default, GitHub cancelled the other job that was still running.

Source

strategy: fail-fast: false so each Node version reports its own result, and the audit step now tells the two failure modes apart.

Source