Chore/audit fixes 20260601 1540 - #81
Merged
Merged
Conversation
Matches root/ui/docs; removes monorepo Bun-version ambiguity. Audit: F006
actions/checkout@v6.0.2, oven-sh/setup-bun@v2.2.0, lycheeverse/lychee-action@v2.8.0, opentofu/setup-opentofu@v2.0.1 — restores the repo's SHA-pin supply-chain posture. SHAs for lychee/opentofu resolved from each repo's latest release via GitHub API. Audit: F002
Unifies on 7c1e4cf0 (v4), the SHA used by the other 10 security workflows. Audit: F003
Removes a root RCE vector (unverified remote installer piped to bash) from first-boot cloud-init. Distro packages are GPG-verified by apt and need no SHA pin to maintain. Audit: F001
Adds per-chunk gzip budgets for the 16 previously-unbudgeted lazy pages (SettingsPage 20KB down to NotFoundPage 2KB) so route-level bundle bloat is caught in CI, not in production. Budgets set ~30-50% above measured size. Audit: F004
Adds apps/api/.dockerignore and apps/ui/.dockerignore to the prod-image-build paths filter so a .dockerignore edit (e.g. excluding a sensitive file) triggers a rebuild instead of leaving a stale image. Audit: F011
…on overrides 5s default expect timeout was below full-stack assertion latency, causing false failures on slow CI. Raises baseline to 12s and removes the scattered 5s/10s overrides (all positive waits, so higher is strictly safer) so specs share one consistent timeout. Audit: F009
Adds DATABASE_POOL_SIZE, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_SERVICE_NAME, RESEND_WEBHOOK_SECRET, SENDGRID_WEBHOOK_PUBLIC_KEY (the 5 schema vars genuinely absent — the other vars the audit listed were already present as commented entries). Audit: F007
The page claimed to be 'generated from the registry' but hand-maintained static rule lists while LintMetaCatalog (and its generator + check) sat unused. Wire LintMetaCatalog into the page (mirroring ScriptsCatalog) so the claim is true and the lists can't drift, and regenerate the stale catalog JSON (ui 24->25, api 18->19). Audit: F008
Replaces the Date.now()+Math.random() email suffix (theoretical collision window) with randomUUID(), making the unique-email index collision impossible by construction across parallel workers and re-runs. Removes the need for partial-state cleanup since a UUID email is never reused. Audit: F010
Depending on me.data?.user re-ran the effect on every query refetch (new object reference) even when the identity was unchanged, re-firing Sentry.setUser. Depend on the stable id/email scalars instead. Audit: F012
Adds a complete @sentry/react mock to the test setup so specs run off the real SDK and can assert capture/user calls, plus an ErrorBoundaryProvider test covering the happy path and the captureException-on-throw path. Audit: F013
Adds a //overrides key (ignored by package managers; JSON has no comments) explaining the ws/devalue/qs/tmp security pins and cross-referencing osv-scanner.toml, so maintainers can safely prune them later. Audit: F014
Explains why the template-preview script reads PREVIEW_PORT directly instead of via the validated env schema (dev-only, never runs in the deployed app), so the raw process.env read is intentional and discoverable. Audit: F015
ScriptsCatalog/LintMetaCatalog cast imported JSON to a type without checking the template key exists (LintMetaCatalog silently rendered empty via ?? []). Narrow to | undefined and throw a clear, actionable build-time error so a corrupt/stale catalog surfaces immediately. Audit: F016
Encode the stack's core value into both skills: when a finding is a *class* of defect a linter/parser can catch, the fix is the guardrail PLUS the code change — extend or create the rule, surface the bug through it (RED), then fix (GREEN), then lock it in with a test + regenerated docs. - audit-monorepo: new `guardrail` field on every finding (layer + rule to add/extend), classification mindset rule, and higher-leverage ranking for enforceable findings. Auditor now flags guardrail GAPS (a class a rule claims to cover but missed — e.g. action SHA-pinning had no lint-meta rule). - execute-audit: new "Guardrail-first remediation" section + loop step that prefers extending lint-meta (in-repo) over one-off patches, with the eslint-plugins repo (cross-repo) noted as the other layer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
bun run check(orbun run check:fullfor the cross-app pass) from the repo rootcd infra/compose/compose && ./dev.sh upApp merge bars
cd apps/api && bun run validatecd apps/ui && bun run validatecd apps/docs && bun run build:cibun run check(from repo root)Conventions
any, no blindas, no!.env.example(+ SECURITY.md when relevant)Screenshots