The commit that fixed my only security advisory failed its security audit. The audit never ran.

Описание и применение

В CI-рабочем процессе npm audit ошибочно помечал недоступность внешнего сервиса как уязвимость, что приводило к ложному красному статусу и публикации релиза без надлежащего контроля. Добавлен отказоустойчивый механизм с повторными попытками и отключен fail-fast, чтобы каждый Node‑вариант корректно сообщал результат.

Задача

CI security audit failed due to external service outage, causing false red CI status and release without proper gate.

Результат

CI now distinguishes between real vulnerabilities and transient service outages, reducing false positives and ensuring releases are gated by actual security status.

Рабочий процесс

• 1. Merge Dependabot PRs before cutting release tags.
• 2. Configure CI matrix with strategy.fail-fast:false.
• 3. Run npm audit with retry loop: attempt up to 3 times, retry after 30s if audit endpoint error.
• 4. Exit 0 on successful audit, exit 1 on real vulnerability or after retries.
• 5. Publish release after CI passes for all matrix jobs.

Доказательства

The audit endpoint was unreachable, npm audit exited non-zero, the step failed, and because the matrix has fail-fast on by default, GitHub cancelled the other job that was still running.

Источник

strategy: fail-fast: false so each Node version reports its own result, and the audit step now tells the two failure modes apart.

Источник