feat(ci): daily dependency check of master

[jbocce]

What

A weekday workflow that checks master's dependencies for high and critical advisories, and flags the ones that are in the viewer build. It can also be run by hand on any branch.

How it works

1. Builds the viewer the same way as build:viewer:ci. A small wrapper config loads rsbuild.config.ts unchanged.
2. Lists the npm packages in dist:
   • packages named in the build's source maps;
   • packages copied into dist whole (today onnxruntime-web and dicom-microscopy-viewer), with their dependencies from the lockfile.
3. Audits every package in pnpm-lock.yaml with npm's advisory endpoint (the one pnpm audit uses), and writes a run summary with four lists:
   • Review immediately: critical or high, in the viewer build
   • Review promptly: critical, not in the build
   • Review soon: high, not in the build
   • Ignored, update available: ignored advisories that a newer version fixes

The summary is public, so each row shows only the advisory link and the package name. The log shows counts only.

When the run fails

• Something to review immediately. The summary is written, then the run fails so GitHub sends its failure email. For the scheduled run, that goes to whoever last changed the cron line.
• The check can't do its job. For example, the build fails, no packages are found in the source maps, or npm can't be reached. The error is "Dependency check failed", and no summary is written.

Other findings never fail the run.

Also in this PR

• The PR audit report now lists the packages a PR changes (collapsed table).
• Backslashes in advisory titles are now escaped in the PR audit report.
• A unit test fails if build:viewer:ci changes and the workflow's build step no longer matches it.

Limits

• It finds what pnpm audit finds, no more. Code that a library bundles inside itself is only seen at the lockfile's version.
• A package copied into dist some other way than output.copy isn't seen as "in the build". Its findings show under "promptly" or "soon" instead of "immediately".
• Manual runs on older branches built with webpack (e.g. release/3.13) use that branch's rsbuild.config.ts, so the list may differ from that branch's real build.

Testing

• Unit tests: npm test in .scripts/dependency-audit (run by CircleCI UNIT_TESTS).
• Runs on a fork:
  • today's master: 318 packages in the build; 0 to review immediately, 4 promptly, 3 soon, 1 ignored with an update
  • production source maps turned off: failed with "Dependency check failed"
  • moment pinned to 2.29.3: listed under "Review immediately", and the run failed

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added an automated weekday dependency check, with an option to run it manually for a selected branch.
  • Reports include affected packages, advisory links, and package version changes. Critical findings in the built viewer are flagged for immediate review.
• Improvements
  • Dependency reports are easier to read, with safeguards for long package lists and special characters.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[netlify]

✅ Deploy Preview for ohif-dev ready!

Name	Link
🔨 Latest commit	6988f42
🔍 Latest deploy log	https://app.netlify.com/projects/ohif-dev/deploys/6ac83f239457c40008137c5a
😎 Deploy Preview	https://deploy-preview-6343--ohif-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5f78f0e1-1ac8-4eba-9b9f-29297e743c0a

📥 Commits

Reviewing files that changed from the base of the PR and between d3c64d0 and 6988f42.

📒 Files selected for processing (9)

• .github/workflows/dependency-check-daily.yml
• .scripts/dependency-audit/audit.mjs
• .scripts/dependency-audit/audit.test.mjs
• .scripts/dependency-audit/build-step.test.mjs
• .scripts/dependency-audit/daily.mjs
• .scripts/dependency-audit/daily.test.mjs
• .scripts/dependency-audit/dist-packages.mjs
• .scripts/dependency-audit/dist-packages.test.mjs
• .scripts/dependency-audit/rsbuild.audit.config.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

This change adds a weekday and manually triggered workflow that builds a selected branch’s viewer, inventories packages in the build, and audits npm advisories. The lockfile report also gains a package-version changes table.

Changes

Dependency audit

Layer / File(s)	Summary
Lockfile change reporting .scripts/dependency-audit/audit.mjs, .scripts/dependency-audit/audit.test.mjs	The report computes package versions added and removed between lockfiles. It sanitizes table cells and limits the change table to 300 rows. Tests cover version differences and escaping.
Viewer package inventory .scripts/dependency-audit/rsbuild.audit.config.ts, .scripts/dependency-audit/dist-packages.mjs, .scripts/dependency-audit/dist-packages.test.mjs	The audit build records its output and copy rules and enables source maps for dependencies. The extractor combines packages found in source maps with dependency trees for packages copied whole.
Daily advisory classification and summary .scripts/dependency-audit/daily.mjs, .scripts/dependency-audit/daily.test.mjs	The script filters lockfile entries, queries npm advisories, groups critical and high findings, checks ignored advisories for updates, and writes a summary. Only immediate findings set exit status 1; operational errors exit with status 2.
Scheduled workflow execution .github/workflows/dependency-check-daily.yml, .scripts/dependency-audit/build-step.test.mjs	The workflow runs on weekdays or manually for a selected branch. It builds the viewer, extracts packages, and runs the audit. Tests compare the workflow build command with the CI build scripts.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as GitHub Actions workflow
  participant Build as Rsbuild viewer build
  participant Extractor as dist-packages.mjs
  participant Audit as daily.mjs
  participant Registry as npm bulk advisory endpoint
  Workflow->>Build: Build viewer and write audit record
  Workflow->>Extractor: Pass audit record and target lockfile
  Extractor-->>Workflow: Write package inventory
  Workflow->>Audit: Pass lockfile, workspace, inventory, and branch label
  Audit->>Registry: Query advisories for package versions
  Registry-->>Audit: Return advisory findings
  Audit-->>Workflow: Write summary and set exit status

Loading

Merge Risk: ⚪ Minimal · up to 6988f

The reviewed dependency check is mergeable after normal checks; no actionable issue remains from this review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check		The description provides detailed context, implementation details, failure behavior, limitations, and testing results. However, it does not use the required template sections and omits the required ch…	Update the description to include the required Context, Changes & Results, Testing, Checklist, and Tested Environment sections. Complete every checklist item, and provide the actual OS, Node.js version, and browser values. Confirm documenta…
Docstring Coverage		Docstring coverage is 70.37% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 8 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check		The title clearly identifies the main change: a CI workflow for daily dependency checks of the master branch. It follows the repository's semantic-release format and is concise.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides detailed context, implementation details, failure behavior, limitations, and testing results. However, it does not use the required template sections and omits the required checklist confirmations and tested-environment details.

Resolution

Update the description to include the required Context, Changes & Results, Testing, Checklist, and Tested Environment sections. Complete every checklist item, and provide the actual OS, Node.js version, and browser values. Confirm documentation and code-documentation requirements explicitly.

Full details: Docstring Coverage

Explanation

Docstring coverage is 70.37% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 27 functions across 8 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cypress]

Viewers    Run #6880

Run Properties:   Passed #6880  •  6988f421ce: feat(ci): fail the daily check when there's something to review immediately

Project	Viewers
Branch Review	chore/daily-security-check
Run status	Passed #6880
Run duration	01m 54s
Commit	6988f421ce: feat(ci): fail the daily check when there's something to review immediately
Committer	Joe Boccanfuso
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	28
View all changes introduced in this branch ↗︎