The commit that fixed my only security advisory failed its security audit. The audit never ran.

说明与用途

CI 工作流中，npm audit 错误地将服务不可用视为漏洞，导致错误的红色状态并发布了未正确检查的版本。通过添加重试机制并禁用 fail-fast，确保每个 Node 版本准确报告结果。

问题

CI security audit failed due to external service outage, causing false red CI status and release without proper gate.

结果

CI now distinguishes between real vulnerabilities and transient service outages, reducing false positives and ensuring releases are gated by actual security status.

工作流

• 1. Merge Dependabot PRs before cutting release tags.
• 2. Configure CI matrix with strategy.fail-fast:false.
• 3. Run npm audit with retry loop: attempt up to 3 times, retry after 30s if audit endpoint error.
• 4. Exit 0 on successful audit, exit 1 on real vulnerability or after retries.
• 5. Publish release after CI passes for all matrix jobs.

证据

The audit endpoint was unreachable, npm audit exited non-zero, the step failed, and because the matrix has fail-fast on by default, GitHub cancelled the other job that was still running.

来源

strategy: fail-fast: false so each Node version reports its own result, and the audit step now tells the two failure modes apart.

来源