Fix pinned npm release audit

[endalk200]

Summary

• replace the binary pinned-npm audit gate with an exact advisory/package/version policy
• expire all nine temporary npm 11.18.0 exceptions on 2026-08-24 while rejecting any drift or new finding
• add unit coverage for new advisories, version drift, npm drift, and expiry

Testing

• bun run format:write
• bun run check-types
• bun run lint (passes with four pre-existing CSS specificity warnings)
• bun run test
• exact npm 11.18.0 pack/extract/shrinkwrap/audit reproduction
• bun run release:audit --workspace apps/cli --include @biomejs/biome --include esbuild --include turbo
• bun --filter artiflow build
• npm package verification and smoke test
• actionlint .github/workflows/publish-npm.yml

Greptile Summary

The PR replaces the pinned npm release’s binary audit gate with a narrowly scoped policy for npm 11.18.0.

• Accepts only nine exact advisory, package, and installed-version tuples.
• Rejects new advisories, package-version drift, npm-version drift, and malformed audit output.
• Expires temporary exceptions on 2026-08-24 and adds focused unit coverage.
• Integrates the policy into the npm publishing workflow.

Confidence Score: 5/5

The PR appears safe to merge because no concrete blocking or independently actionable non-blocking defect remains.

The workflow audits the intended extracted npm tree using the pinned audit engine, and the new validator fails closed on npm-version drift, unexpected findings, malformed data, unresolved installed versions, and expired exceptions.

Important Files Changed

Filename	Overview
.github/workflows/publish-npm.yml	Replaces direct audit exit-code enforcement with the new exact-policy validator while preserving shrinkwrap generation and checksum-based staging.
apps/cli/src/release/pinned-npm-audit.ts	Implements fail-closed validation for npm version, audit-report shape, exact advisory/package/version exceptions, unexpected findings, and exception expiry.
apps/cli/src/release/pinned-npm-audit.test.ts	Covers accepted findings, new advisories, dependency-version drift, npm-version drift, expiry, and clean post-expiry reports.
scripts/audit-pinned-npm.ts	Runs the JSON audit, resolves installed versions from the extracted npm tree, invokes policy validation, and reports accepted temporary exceptions.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Download npm 11.18.0 tarball] --> B[Extract npm package]
    B --> C[Generate shrinkwrap]
    C --> D[Run npm audit as JSON]
    D --> E[Resolve installed package versions]
    E --> F{Exact npm version?}
    F -- No --> X[Fail release]
    F -- Yes --> G{All moderate+ findings match allowed advisory/package/version tuples?}
    G -- No --> X
    G -- Yes --> H{Accepted exceptions expired?}
    H -- Yes --> X
    H -- No --> I[Record checksum]
    I --> J[Verify checksum in stage job]
    J --> K[Stage package publish]

Loading

_{Reviews (1): Last reviewed commit: "fix(release): narrowly allow pinned npm ..." | Re-trigger Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
artiflow	Ready	Preview	Aug 10, 2026 2:33pm