From 0656237f6f5d258fc4dfc155d2edb8a24da44c3e Mon Sep 17 00:00:00 2001 From: Felix Geelhaar Date: Sat, 25 Jul 2026 19:37:05 +0200 Subject: [PATCH 1/2] fix(ci): run CI on docs-only PRs so required checks can report MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Branch protection requires `ci / Lint`, `ci / Test (ubuntu-latest)`, `ci / Build` and `ci / Security (nox)`, but the pull_request trigger had paths-ignore for **.md, docs/** and LICENSE. A docs-only PR therefore skipped the whole workflow, the required checks never reported, and the PR was BLOCKED forever — mergeable only via an admin override (this is what blocked #93). Drop paths-ignore from the pull_request trigger so the workflow always runs and reports its required contexts. Running CI on a docs PR is cheap (no Go code changed, so the build/test caches hit). The push-to-main trigger keeps its paths-ignore, so merges of docs changes still skip CI. Mirrors the same fix already applied in warden and nox. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6dbc5f8..1c37307 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,12 @@ on: paths-ignore: ["**.md", "docs/**", "LICENSE"] pull_request: branches: [main] - paths-ignore: ["**.md", "docs/**", "LICENSE"] + # No paths-ignore here: branch protection requires this workflow's status + # checks (ci / Lint, Test, Build, Security (nox)), and a docs-only PR that + # skips the whole workflow never reports them — so the PR is unmergeable + # forever without an admin override. Running CI on docs PRs is cheap (no Go + # code changed → cache hits) and keeps them mergeable; the push-to-main + # trigger above still skips docs, saving minutes on merges. concurrency: group: ${{ github.workflow }}-${{ github.ref }} From 55a7c45f778c42a3fc2ab2e7925ccbb5db9f8ede Mon Sep 17 00:00:00 2001 From: Felix Geelhaar Date: Sat, 25 Jul 2026 17:53:27 +0200 Subject: [PATCH 2/2] fix(security): remediate known CVEs in JS deps Force-patched transitive npm dependencies via package.json overrides to eliminate net-new high-severity CVEs flagged by nox 1.16.1. - fast-uri 3.1.2 -> 3.1.4 (GHSA-4c8g-83qw-93j6 / CVE-2026-13676, host confusion via failed IDN canonicalization; GHSA-v2hh-gcrm-f6hx / CVE-2026-16221, host confusion via literal backslash authority delimiter) - postcss 8.5.16 -> 8.5.18+ (GHSA-r28c-9q8g-f849, path traversal in source map auto-loading) - svgo 4.0.1 -> 4.0.2 (GHSA-2p49-hgcm-8545, removeScripts plugin leaves some executable scripts intact) Verified: build (astro build) and tests (vitest, 29/29) pass; nox scan reports 0 net-new critical/high findings. Claude-Session: https://claude.ai/code/session_01Cr6YdzphmFF3NJqm7kSJom --- docs/package-lock.json | 26 +++++++++++++------------- docs/package.json | 5 ++++- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/docs/package-lock.json b/docs/package-lock.json index 78e47e8..fb72b18 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -4950,9 +4950,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true, "funding": [ { @@ -5991,9 +5991,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.15", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz", - "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "funding": [ { "type": "github", @@ -6224,9 +6224,9 @@ } }, "node_modules/postcss": { - "version": "8.5.16", - "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz", - "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==", + "version": "8.5.23", + "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz", + "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==", "funding": [ { "type": "opencollective", @@ -6243,7 +6243,7 @@ ], "license": "MIT", "dependencies": { - "nanoid": "^3.3.12", + "nanoid": "^3.3.16", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" }, @@ -6806,9 +6806,9 @@ } }, "node_modules/svgo": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.1.tgz", - "integrity": "sha512-XDpWUOPC6FEibaLzjfe0ucaV0YrOjYotGJO1WpF0Zd+n6ZGEQUsSugaoLq9QkEZtAfQIxT42UChcssDVPP3+/w==", + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/svgo/-/svgo-4.0.2.tgz", + "integrity": "sha512-ekx94z1rRc5LDi6oSUaeRnYhd0UOJxdtQCL2rF8xpWxD3TPAsISWOrxezqGovqS38GRZOdpDfvQe3ts6F7nsng==", "license": "MIT", "dependencies": { "commander": "^11.1.0", diff --git a/docs/package.json b/docs/package.json index 4aaabf2..8902866 100644 --- a/docs/package.json +++ b/docs/package.json @@ -25,6 +25,9 @@ }, "overrides": { "devalue": "^5.8.1", - "yaml": "^2.9.0" + "yaml": "^2.9.0", + "fast-uri": "^3.1.4", + "postcss": "^8.5.18", + "svgo": "^4.0.2" } }