ci: stop a registry outage failing the dashboard audit - #52
Merged
Conversation
master went red on 45f46b0 and it was not our code: npm warn audit 400 Bad Request - POST .../security/audits/quick message: 'Invalid package tree, run npm install to rebuild your package-lock.json' npm error audit endpoint returned an error The same commit passed this job on its own PR 45 minutes earlier, and `npm ci && npm audit --audit-level=high` passes locally on that exact lockfile with "found 0 vulnerabilities", exit 0, lockfile unchanged. So the 400 came from registry.npmjs.org, not from the tree. npm exits 1 both for "found vulnerabilities at or above the threshold" and for "could not reach the audit endpoint", and the original step treated them the same. That made CI hostage to npmjs.org availability and turned this into an intermittently red check -- which is the exact failure mode build.yml was deleted for in MoonlightVibe, and the reason given there was that a check nobody trusts is worse than no check. Now: a transport error is retried three times with backoff, and if it still cannot reach the registry the step WARNS and passes, stating plainly that dependencies were not audited in that run. A real finding still fails on the first attempt, unchanged.⚠️ The warning path means a run can be green without having audited anything. That is the lesser evil against a red build caused by someone else's outage, but it is a real gap and the message says so rather than passing quietly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQvL62WkT8xDWXqyjFCGDw
Merged
vibesoftwarecoder
added a commit
that referenced
this pull request
Sep 13, 2026
version.txt 0.6.4 -> 0.6.5, plus the notes the release workflow reads. No code changes -- four merged commits ship: #49 (a streaming seat reported Ready), #50 (a streaming standalone Apollo reported idle), #51 (that warning overstated the stall), #52 (the audit gate failed on a registry outage). ⭐ Three of the four are runtime-verified on the reference host rather than only CI-green: #49 Ready -> Streaming in 6s on connect, back in 3s on disconnect #50 streaming signal correct in BOTH directions, including a live stream the old serverinfo check reported as idle #51 266 ms measured, and the person streaming did not notice it⚠️ And master CI was RED before this. 45f46b0 failed on a 400 from registry.npmjs.org, not on our code -- the same commit had passed its own PR 45 minutes earlier and passed locally afterwards. #52 fixed the gate; the master push on b5feaac is green across all three jobs, checked before cutting rather than assumed. That is worth recording: "the tests pass" is not "master is green", and I reported the first while implying the second. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQvL62WkT8xDWXqyjFCGDw
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
masterwent red on45f46b05, and it was not our code:Why that is the registry and not the lockfile
npm ci && npm audit --audit-level=highpasses locally on that exact lockfile:found 0 vulnerabilities, exit 0, lockfile unchanged afterwardsSo the 400 came from
registry.npmjs.org.The actual defect, which is mine
npmexits 1 both for "found vulnerabilities at or above the threshold" and for "could not reach the audit endpoint". The original step treated those as the same thing.When I added this gate I wrote that an upstream advisory breaking CI was "the intended behaviour, not a bug" — and it is. But I never separated a finding from a failure to check, which made CI hostage to npmjs.org availability and turned this into an intermittently red check.
That is the exact failure mode
build.ymlwas deleted for in MoonlightVibe, and the reason given there was that a check nobody trusts is worse than no check. Same mistake, different repo, three hours apart.What changes
🤖 Generated with Claude Code
https://claude.ai/code/session_01SQvL62WkT8xDWXqyjFCGDw