fix(ci): never trust audit output from a terminated run, narrow the skip

Two fail-opens in the audit gate.

A killed `bun audit` can flush parseable JSON before it dies. The empty-
stdout check ran first, so that partial output reached JSON.parse and was
reported as a complete verdict. Verified against the pre-fix script: a
process that writes {"advisories":{}} then hangs yields
"Summary: blocking=0 ... total=0" and exit 0. Termination is now decided
before stdout is looked at.

The outage skip also applied to any failure to run, so a bun crash or an
unreadable lockfile would silently skip the audit too. It is now gated on
an identified unreachable-service condition; every other failure to run
still exits non-zero.

Detect termination through signalCode / exitedDueToTimeout rather than
`exitCode === null`. The runtime does return null there on 1.3.12 and
1.3.14, but the declared type is `number`, so the comparison is not
expressible in typed code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUPpJPtxAaHWrBsjytRGyM

Author: chrisleekr

scripts/audit-ci.ts

@@ -69,45 +69,71 @@ function runAudit(): Attempt {
     stdout: new TextDecoder().decode(proc.stdout).trim(),
     stderr: new TextDecoder().decode(proc.stderr).trim(),
     exitCode: proc.exitCode,
-    // A timeout kill arrives as SIGTERM, which leaves exitCode null. Classify
-    // that as a failure to run, not as a clean "no advisories" result, so the
-    // outcome is reported as a skipped audit rather than as a pass.
-    signalled: proc.exitCode === null,
+    // `exitCode` is declared `number` but is null at runtime on a signal kill
+    // (verified on bun 1.3.12 and 1.3.14), so it cannot carry this check in
+    // typed code. These two optional fields are the documented way to detect
+    // termination: https://bun.com/reference/bun/SyncSubprocess
+    signalled: proc.signalCode != null || proc.exitedDueToTimeout === true,
   };
 }
 
+// `bun audit` exits 1 when it FINDS advisories, so a non-zero exit alongside a
+// report is the normal path. Only an empty report marks a run that never
+// happened.
+function failedToRun(a: Attempt): boolean {
+  return a.signalled || (a.exitCode !== null && a.exitCode !== 0);
+}
+
+// A killed process can still have flushed parseable JSON, which would be a
+// partial report. Treat any termination as "no report" so a truncated one is
+// never mistaken for a verdict.
+function producedNoReport(a: Attempt): boolean {
+  return a.signalled || (!a.stdout && failedToRun(a));
+}
+
+// Only a genuine failure to reach the advisory service earns the skip below.
+// Every other failure to run (bun crash, unreadable lockfile, bad credentials)
+// says something about this repo and still hard-fails.
+const SERVICE_UNREACHABLE =
+  /audit request failed|ConnectionClosed|ConnectionRefused|ConnectionTimedOut|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|fetch failed/i;
+
+function isServiceUnreachable(a: Attempt): boolean {
+  // A killed attempt is one that got 60s to answer and never did, which is
+  // unreachable from this side whatever the cause.
+  return a.signalled || SERVICE_UNREACHABLE.test(a.stderr);
+}
+
+// Reached only when every attempt failed to produce a report. An unreachable
+// advisory service yields no verdict in either direction, and blocking every
+// merge for the length of an upstream outage buys no security, so warn loudly
+// and pass. Anything else exits non-zero.
+function skipOrFail(a: Attempt): never {
+  const how = a.signalled ? "was killed after not responding" : `exited with code ${a.exitCode}`;
+  if (isServiceUnreachable(a)) {
+    console.warn(
+      `::warning::bun audit ${how} and produced no usable JSON after ${MAX_ATTEMPTS} attempts. Dependency audit SKIPPED for this run.`,
+    );
+    if (a.stderr) console.error(a.stderr);
+    process.exit(0);
+  }
+  console.error(`::error::bun audit ${how} without reaching the advisory service.`);
+  if (a.stderr) console.error(a.stderr);
+  process.exit(a.exitCode ?? 1);
+}
+
 let attempt = runAudit();
-for (let i = 2; i <= MAX_ATTEMPTS && !attempt.stdout && failedToRun(attempt); i++) {
+for (let i = 2; i <= MAX_ATTEMPTS && producedNoReport(attempt); i++) {
   console.warn(`::warning::bun audit attempt ${i - 1}/${MAX_ATTEMPTS} produced no JSON, retrying.`);
   if (attempt.stderr) console.error(attempt.stderr);
   Bun.sleepSync(BACKOFF_MS);
   attempt = runAudit();
 }
 
-function failedToRun(a: Attempt): boolean {
-  return a.signalled || (a.exitCode !== null && a.exitCode !== 0);
-}
+if (producedNoReport(attempt)) skipOrFail(attempt);
 
 const { stdout, stderr } = attempt;
 
 if (!stdout) {
-  // Empty stdout + a signal or non-zero exit means bun audit failed to RUN
-  // (registry outage, network error), not that it audited cleanly. The retries
-  // above already absorbed a transient blip, so reaching here means the
-  // advisory service is down and the gate has no signal either way. Blocking
-  // every merge for the length of an upstream outage buys no security, so warn
-  // loudly and pass. Real advisories and unparseable output below still
-  // hard-fail, and trivy-scan.yml scans the published images daily.
-  if (failedToRun(attempt)) {
-    const how = attempt.signalled
-      ? "was killed by a signal"
-      : `exited with code ${attempt.exitCode}`;
-    console.warn(
-      `::warning::bun audit ${how} and produced no JSON after ${MAX_ATTEMPTS} attempts. Dependency audit SKIPPED for this run.`,
-    );
-    if (stderr) console.error(stderr);
-    process.exit(0);
-  }
   console.log("bun audit produced no JSON output (no advisories).");
   if (stderr) console.error(stderr);
   process.exit(0);