[ExcelDsigN-tech]

Overview

Follow-up to #839. Trivy, npm audit and cargo audit ran on PRs but with continue-on-error: true, because main still had high/critical findings. #901 and #904 cleared or baselined those findings, so the three jobs now block on pull requests, matching Semgrep.

Feature Summary

• trivy, npm-audit and cargo-audit fail the PR on high or critical findings
• Scheduled and manual runs stay non-blocking and keep feeding the weekly report

Technical Implementation

• .github/workflows/security-gates.yml: continue-on-error: true becomes continue-on-error: ${{ github.event_name != 'pull_request' }} on the three jobs, the same expression Semgrep already uses. Stale "does not block yet" comments replaced.
• Accepted findings stay in the existing ignore lists: .trivyignore and contracts/.cargo/audit.toml (RUSTSEC-2026-0387, [contracts] Resolve RUSTSEC-2026-0387 (crypto-bigint) from soroban-sdk 22 tree #902).
• These job names are not in the main ruleset's required checks, so a red result shows as a failed check but does not by itself stop a merge. Adding them to the ruleset is a separate repo-settings change.

Test Coverage

Checked against current main before flipping:

• npm audit --audit-level=high: backend, frontend, scripts exit 0
• cargo audit in contracts/: exit 0
• Trivy 0.69.3 fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 on a clean export of main: exit 0
• actionlint 1.7.7 on the workflow: clean
• ./scripts/ci-local.sh guards: pass
• This PR's own Security Gates run exercises the three jobs in blocking mode

Checklists

General

• Ran ./scripts/ci-local.sh <area> and it passes
• Tests added or updated for the change (workflow config only)
• No skipped tests, removed assertions or raised limits
• Docs updated if behaviour changed (workflow comments updated)
• Conventional Commits title and messages
• Security-sensitive change: .github/THREAT_MODEL.md attached and maintainer review requested

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e9ad185b-4253-4a86-983d-e93ad353d372

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn