From b5f88f8944b944ca82a0e66f4db2b0e5435c6087 Mon Sep 17 00:00:00 2001 From: Diego Suntaxi Date: Tue, 15 Sep 2026 18:26:48 -0500 Subject: [PATCH 1/3] [INT-3874] Harden CI workflow and fix red audit gate - Regenerate package-lock.json via `npm audit fix`: js-yaml 4.1.1 -> 4.3.2 and brace-expansion 1.x/2.x/5.x to patched releases. Clears the two high-severity advisories that have failed the Security audit job on master since 2026-09-15. package.json is unchanged. - ci.yml: add concurrency (cancel superseded runs per branch/PR) and a 10-minute timeout on every job. No paths-ignore on purpose: with required status checks, a skipped workflow leaves docs-only PRs unmergeable (explained in a comment in the file). - ci.yml + npm-publish.yml: bump actions/checkout, actions/setup-node and actions/upload-artifact to v7. The v2/v4 releases target the deprecated Node 20 runner and now emit warnings on every job. - Remove dead .travis.yml. - CHANGELOG: Unreleased entry. Already done on master by #127 and therefore not repeated here: lockfile JSON repair, createRequire replacing the JSON import attribute, Node 20/22/24 matrix, lint/audit/coverage jobs, mocha env for test/**. engines stays at >=20.0.0 because the `with {}` syntax that motivated >=20.10.0 is no longer used. Verified with fnm on Node 20.20.2, 22.22.2 and 24.15.0: npm ci, lint (0 errors), 44 tests passing, coverage thresholds met, audit clean at high. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 32 ++++++++++++++++------- .github/workflows/npm-publish.yml | 8 +++--- .travis.yml | 7 ------ CHANGELOG.md | 8 ++++++ package-lock.json | 42 +++++++++++++++++++------------ 5 files changed, 61 insertions(+), 36 deletions(-) delete mode 100644 .travis.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bf6abb2..39e7fd8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,10 +16,21 @@ on: push: branches: [master] +# Deliberately no paths-ignore: branch protection requires these checks, and +# a workflow that is skipped for docs-only changes never reports them, which +# leaves the PR unmergeable. Each job takes ~20s, so always running is cheap. + +# Cancel superseded runs on the same branch/PR so only the latest commit is +# tested. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + jobs: test: name: Test (Node ${{ matrix.node-version }}) runs-on: ubuntu-latest + timeout-minutes: 10 strategy: fail-fast: false matrix: @@ -28,8 +39,8 @@ jobs: # caught here instead of at release. node-version: [20, 22, 24] steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ matrix.node-version }} cache: npm @@ -39,16 +50,17 @@ jobs: coverage: name: Coverage runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 cache: npm - run: npm ci # Runs the suite under c8 and enforces the thresholds in .c8rc.json. - run: npm run coverage - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: always() with: name: coverage-lcov @@ -58,9 +70,10 @@ jobs: audit: name: Security audit runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 cache: npm @@ -72,9 +85,10 @@ jobs: lint: name: Lint runs-on: ubuntu-latest + timeout-minutes: 10 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 cache: npm diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 59e142b..2d49bad 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,8 +12,8 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v2 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 - run: npm ci @@ -23,8 +23,8 @@ jobs: needs: build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - uses: actions/setup-node@v2 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 20 registry-url: https://registry.npmjs.org/ diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 938b1cb..0000000 --- a/.travis.yml +++ /dev/null @@ -1,7 +0,0 @@ -language: node_js -node_js: - - "stable" -cache: - directories: - - node_modules -install: npm install diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a70b13..d42830f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### Changed +- CI: cancel superseded runs on the same branch (`concurrency`) and cap every job at 10 minutes. +- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v2/v4 target the deprecated Node 20 runner). +- Regenerated `package-lock.json` to pick up patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate. + +### Removed +- Dead `.travis.yml` (Travis CI has not run for this repo since GitHub Actions was adopted). + ## [1.4.1] - 2026-07-13 ### Added - Regression tests covering all five error branches (RateLimitError, PermissionError, ServiceError x2, HttpError, and the ValidationError path in the Onfleet constructor), none of which had prior test coverage. diff --git a/package-lock.json b/package-lock.json index 83a20ea..ef31be5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -524,16 +524,16 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/brace-expansion/node_modules/balanced-match": { @@ -1871,9 +1871,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { @@ -2630,10 +2630,20 @@ } }, "node_modules/js-yaml": { - "version": "4.1.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz", - "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==", + "version": "4.3.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz", + "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==", "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], "license": "MIT", "dependencies": { "argparse": "^2.0.1" @@ -2817,9 +2827,9 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "1.1.15", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz", - "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==", + "version": "1.1.21", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz", + "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==", "dev": true, "license": "MIT", "dependencies": { @@ -2884,9 +2894,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz", - "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==", + "version": "2.1.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz", + "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==", "dev": true, "license": "MIT", "dependencies": { From 46ace1183b1320cae1b11dbaab0cc2d9f966d8bf Mon Sep 17 00:00:00 2001 From: Diego Suntaxi Date: Fri, 18 Sep 2026 18:08:33 -0500 Subject: [PATCH 2/3] [INT-3874] Address review: publish timeouts, changelog accuracy - npm-publish.yml: timeout-minutes: 10 on build, publish and notify so a stalled release job fails fast instead of holding a runner for 6 hours. No concurrency group on purpose: cancelling an in-flight npm publish is worse than a slow one, and release-triggered runs do not overlap. - CHANGELOG: only v4 of the bumped actions targets the Node 20 runtime (v2 was node12/16), so the parenthetical now says v4. - CHANGELOG: lockfile advisory fix moved from Changed to Security, per Keep a Changelog and the repo PR template. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/npm-publish.yml | 3 +++ CHANGELOG.md | 8 +++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 2d49bad..c03e5dc 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -11,6 +11,7 @@ jobs: build: runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -22,6 +23,7 @@ jobs: publish: needs: build runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 @@ -36,6 +38,7 @@ jobs: notify: needs: publish runs-on: ubuntu-latest + timeout-minutes: 10 steps: - uses: slackapi/slack-github-action@v1.18.0 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index d42830f..7d32c99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,13 +6,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Changed -- CI: cancel superseded runs on the same branch (`concurrency`) and cap every job at 10 minutes. -- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v2/v4 target the deprecated Node 20 runner). -- Regenerated `package-lock.json` to pick up patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate. +- CI and publish workflows: cancel superseded CI runs on the same branch (`concurrency`) and cap every job at 10 minutes. +- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v4 targets the deprecated Node 20 runner). ### Removed - Dead `.travis.yml` (Travis CI has not run for this repo since GitHub Actions was adopted). +### Security +- Regenerated `package-lock.json` to pick up patched `js-yaml` (4.3.2) and `brace-expansion`, clearing the high-severity advisories that failed the `npm audit` gate. + ## [1.4.1] - 2026-07-13 ### Added - Regression tests covering all five error branches (RateLimitError, PermissionError, ServiceError x2, HttpError, and the ValidationError path in the Onfleet constructor), none of which had prior test coverage. From d0b476496c7a0678d6ae3d074a0378c93b0861e3 Mon Sep 17 00:00:00 2001 From: Diego Suntaxi Date: Mon, 21 Sep 2026 09:59:13 -0500 Subject: [PATCH 3/3] [INT-3874] Address review: keep master CI runs, cache npm in publish - ci.yml: only cancel in-progress runs for pull_request events. Pushes to master share one concurrency group, so cancelling there could leave a merge commit with no CI verdict after back-to-back merges. - npm-publish.yml: add `cache: npm` to both setup-node steps to match ci.yml; this also drops the trailing whitespace on `node-version: 20`. - CHANGELOG.md: the publish workflow was bumped from v2, not v4, so the parenthetical now says "the replaced v2/v4 releases"; the concurrency bullet now says runs of the same pull request are cancelled. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/ci.yml | 8 +++++--- .github/workflows/npm-publish.yml | 4 +++- CHANGELOG.md | 4 ++-- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 39e7fd8..13bb259 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,11 +20,13 @@ on: # a workflow that is skipped for docs-only changes never reports them, which # leaves the PR unmergeable. Each job takes ~20s, so always running is cheap. -# Cancel superseded runs on the same branch/PR so only the latest commit is -# tested. +# Cancel superseded runs of the same PR so only the latest commit is tested. +# Pushes to master are never cancelled: back-to-back merges share the +# `refs/heads/master` group, and cancelling would leave the earlier merge +# commit without a CI verdict. concurrency: group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: test: diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index c03e5dc..294a439 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -16,7 +16,8 @@ jobs: - uses: actions/checkout@v7 - uses: actions/setup-node@v7 with: - node-version: 20 + node-version: 20 + cache: npm - run: npm ci - run: npm test @@ -29,6 +30,7 @@ jobs: - uses: actions/setup-node@v7 with: node-version: 20 + cache: npm registry-url: https://registry.npmjs.org/ - run: npm ci - run: npm publish --access public diff --git a/CHANGELOG.md b/CHANGELOG.md index 5c97df6..8272f6e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,8 +6,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] ### Changed -- CI and publish workflows: cancel superseded CI runs on the same branch (`concurrency`) and cap every job at 10 minutes. -- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (v4 targets the deprecated Node 20 runner). +- CI and publish workflows: cancel superseded CI runs of the same pull request (`concurrency`) and cap every job at 10 minutes. +- CI and publish workflows: bump `actions/checkout`, `actions/setup-node` and `actions/upload-artifact` to v7 (the replaced v2/v4 releases target deprecated Node runtimes). ### Removed - Dead `.travis.yml` (Travis CI has not run for this repo since GitHub Actions was adopted).