opendefensecloud / solution-arsenal / 38865530350
79%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 97
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 79.13% (+0.08%) from 79.053%
38865530350

push

github

web-flow 
chore(renovate): enable lock file maintenance for npm (#876)

## What
Enable Renovate lock file maintenance for the npm manager so
`web/pnpm-lock.yaml` gets refreshed alongside `flake.lock`.

## Why
OSV-Scanner is failing on main because of GHSA-68fv-2mgg-jv7q in
`source-map-js` 1.2.1 (fixed in 1.2.2). It is only a transitive
dependency (via `postcss`, `css-tree` and `@tailwindcss/node`), so
neither the patch nor the minor group touches it, and
`osvVulnerabilityAlerts` only covers direct dependencies. The shared
`opendefensecloud/renovate-config` enables lock file maintenance for nix
only, so transitive web dependencies are never refreshed and every such
fix needs a manual bump.

This is repo-local because solution-arsenal is currently the only repo
in the org with a JS lockfile.

## Testing
- `renovate.json` validated as JSON
- After merge, Renovate should update the open lock file maintenance PR
(#875) to include `web/pnpm-lock.yaml` with `source-map-js` 1.2.2, which
clears the OSV-Scanner failure on main

## Notes for reviewers
Lock file maintenance is one PR across all managers, so the existing
`flake.lock` refresh PR will also carry a full refresh of transitive web
dependencies from now on. It is not automerged and gets the
`ok-to-image`/`ok-to-e2e` labels from the shared config, so e2e runs
against the refreshed lockfile.

## Checklist
- [x] Tests added/updated, or confirmed that no tests are required
- [x] No breaking changes, or upgrade path documented above
- [x] Readable commit history (squashed and cleaned up as desired)
- [ ] AI code review considered and comments resolved


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* npm dependency lockfiles are now maintained automatically. This helps
keep dependency records up to date as part of routine maintenance. No
changes to the app’s user-facing features are included.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

5183 of 6550 relevant lines covered (79.13%)

34.6 hits per line

Coverage Regressions

Lines Coverage ∆ File
1
88.66
-1.03% pkg/discovery/runner.go
Jobs
ID Job ID Ran Files Coverage
1 38865530350.1 97
79.13
GitHub Action Run
Source Files on build 38865530350