[INT-3874] Harden CI workflow and fix red audit gate

[diego-suntaxi-onfleet]

Describe the solution

The Security audit job on master failed on 2026-09-15 because the lockfile pinned js-yaml 4.1.1 and older brace-expansion releases with high-severity advisories. That part has since landed on master through #131 and #132 (this branch is merged up to them and no longer changes package.json or the lockfile). What remains here is the CI hardening: run concurrency, job timeouts, current action versions, and removal of the dead Travis config.

Most of the original CI work (PR-level workflow, Node 20/22/24 matrix, lint/audit/coverage jobs, createRequire import fix, lint baseline) already landed in #127 and is not repeated here.

Two deliberate choices:

• No paths-ignore for README/CHANGELOG. Once branch protection requires these checks, a workflow that is skipped for docs-only changes never reports them, and the PR cannot be merged. Each job takes about 20 seconds, so always running is cheap. A comment in ci.yml records this.
• engines stays at >=20.0.0. The >=20.10.0 bump was only needed for the with { type: 'json' } import syntax, which [INT-3686] Overhaul CI/CD and quality assurance #127 replaced with createRequire.

Verified with fnm on Node 20.20.2, 22.22.2 and 24.15.0: npm ci, npm run lint (0 errors), npm test (44 passing), npm run coverage (thresholds met), npm audit --audit-level=high (0 vulnerabilities).

---

Changed

• ci.yml: concurrency with cancel-in-progress so superseded runs on the same branch/PR are cancelled; timeout-minutes: 10 on every job in both ci.yml and npm-publish.yml.
• ci.yml and npm-publish.yml: actions/checkout, actions/setup-node and actions/upload-artifact bumped to v7. The v2/v4 releases target the deprecated Node 20 runner and now emit warnings on every job.

Removed

• .travis.yml (dead since GitHub Actions was adopted).

Security

• No dependency changes in this PR. The js-yaml 4.3.2 and brace-expansion patches that make the audit gate green came in via fix: remediate brace-expansion vulnerability #131 and fix: remediate js-yaml vulnerability #132; the changelog entry here records them for the next release.

---

Follow-up for a repo admin after this merges (not doable from a PR)

Settings → Branches → master → enable Require status checks to pass before merging with Require branches to be up to date before merging, and select these checks:

• Lint
• Test (Node 20)
• Test (Node 22)
• Test (Node 24)
• Security audit
• Coverage

The names only appear in the picker after they have run at least once, which this PR's CI run takes care of.

🤖 Generated with Claude Code

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Bumps GitHub Actions to v7, adds CI concurrency/timeouts, drops the dead Travis config, and regenerates package-lock.json to clear dev-only audit advisories without changing package.json; a bounded CI/security hardening change.

Re-trigger cubic</sub>

[jvoliveiran]

Code review — round 1

Reviewed the branch diff against master with the PR description and INT-3874 as context. The CI hardening is sound: the v7 actions resolve, all checks pass, and the diff matches the stated remaining scope of the ticket.

Findings — no blocks:

• 1 suggestion (potential bug): cancel-in-progress also applies to push runs on master, so back-to-back merges can leave a merge commit without any CI verdict.
• 3 neats: missing cache: npm in the publish workflow, a changelog parenthetical that misstates the replaced action version, and pre-existing trailing whitespace on a touched hunk.

One additional finding — slackapi/slack-github-action@v1.18.0 still targets the deprecated Node 16 runtime, the same warning class this PR removes elsewhere — was withdrawn as out of scope during the local review round. Recommended as a small follow-up ticket (the job already sets the v2-only SLACK_WEBHOOK_TYPE env var, so the config half-anticipates the upgrade).

No open blocks and one open suggestion, so this review approves.

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Hardens CI workflows (action version bumps, job timeouts, PR-only run cancellation, npm cache) and removes the dead Travis config, with changelog updates; development-only tooling changes with no product-behavior impact.

Re-trigger cubic</sub>

[jvoliveiran]

Code review — round 2

All four findings from round 1 are fixed in commit d0b4764 and verified against the code:

• Fixed: conditional cancel-in-progress (master push runs are no longer cancellable), cache: npm on both publish-workflow jobs, changelog parenthetical corrected to the replaced v2/v4 releases, trailing whitespace removed.
• Withdrawn (round 1): the slackapi/slack-github-action@v1.18.0 Node 16 runtime bump — out of scope here; recommended as a small follow-up ticket.
• Still open: none. New findings: none.

All CI checks pass on the latest commit. Approving.

Approval posted from the wrong account; re-approved from joao-onfleet.

[joao-onfleet]

Re-posting the approval from the correct account (the two dismissed approvals from jvoliveiran were mine, posted from my personal account by mistake).

Review outcome after 2 rounds: all four findings fixed in d0b4764 and verified (conditional cancel-in-progress so master push runs are never cancelled, cache: npm on both publish-workflow jobs, changelog v2/v4 wording, trailing whitespace); one finding withdrawn as out of scope (slackapi/slack-github-action Node 16 runtime bump — recommended as a follow-up ticket). No open findings, all CI checks pass.