ci: restore audit-fix workflow using pnpm by thypon · Pull Request #401 · brave/pull-merge

thypon · 2026-09-01T00:14:19Z

Recreates the weekly dependency-audit-fix automation that was lost in the pnpm migration (7f03ed8 removed .github/workflows/npm-audit-fix.yml), which left #388 stale.

Changes

Adds .github/workflows/pnpm-audit-fix.yml: scheduled cron 0 10 * * 1 + manual dispatch
Runs pnpm audit --fix=update (updates pnpm-lock.yaml with security fixes) and opens a PR when the lockfile changes
Uses repo-standard pinned actions: [email protected], pnpm/[email protected], [email protected] with pnpm cache
Pushes branch automated/pnpm-audit-fix, PR labeled dependencies

Verified: pnpm audit --fix=update valid with pnpm 11.22.0 (exit 0, 0 vulnerabilities were fixed); actionlint clean on the new workflow.

Closes #388

Weekly scheduled npm audit fix workflow was removed during the pnpm migration (7f03ed8), leaving PR #388 stale. Recreate it for pnpm: pnpm audit --fix=update updates the lockfile with security fixes, then opens a PR when it changes.

github-actions · 2026-09-01T00:15:06Z

bedrock debug - [puLL-Merge] - brave/pull-merge@401

Diff

diff --git a/.github/workflows/pnpm-audit-fix.yml b/.github/workflows/pnpm-audit-fix.yml
new file mode 100644
index 0000000..58cc0cb
--- /dev/null
+++ .github/workflows/pnpm-audit-fix.yml
@@ -0,0 +1,72 @@
+name: pnpm audit fix
+
+on:
+  schedule:
+    # Run every Monday at 10:00 AM UTC (after model updates at 9:00)
+    - cron: '0 10 * * 1'
+  workflow_dispatch: # Allow manual triggering
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  audit-fix:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: '24.x'
+          cache: 'pnpm'
+
+      - name: Run pnpm audit fix
+        id: audit-fix
+        continue-on-error: true
+        run: pnpm audit --fix=update
+
+      - name: Check for changes and create PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if git diff --quiet; then
+            echo "No audit fixes needed"
+            exit 0
+          fi
+
+          # Configure git
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Create and switch to new branch
+          BRANCH_NAME="automated/pnpm-audit-fix"
+          git checkout -b "${BRANCH_NAME}"
+
+          # Commit changes
+          git add package.json pnpm-lock.yaml
+          if [ -f pnpm-workspace.yaml ]; then git add pnpm-workspace.yaml; fi
+          git commit -m "Fix pnpm audit vulnerabilities"
+
+          # Push branch
+          git push origin "${BRANCH_NAME}" --force
+
+          # Create PR (will fail gracefully if PR already exists)
+          gh pr create \
+            --title "Fix pnpm audit vulnerabilities" \
+            --body "This PR automatically fixes dependency audit vulnerabilities by running \`pnpm audit --fix=update\`.
+
+          ## Changes
+          - Updated \`pnpm-lock.yaml\` with security fixes
+
+          This PR was automatically generated by the \`pnpm-audit-fix\` workflow." \
+            --base main \
+            --head "${BRANCH_NAME}" \
+            --label dependencies \
+            --repo "${GITHUB_REPOSITORY}" || echo "PR already exists or could not be created"

Description

Adds a scheduled GitHub Actions workflow that runs pnpm audit --fix=update weekly and opens a PR with any resulting dependency updates.

Possible Issues

Fixed branch name (automated/pnpm-audit-fix) combined with --force push means successive runs silently overwrite the branch. If a previous PR is open and under review, the force-push rewrites its history without closing/reopening it, making review diffs unreliable.
continue-on-error: true on the audit step means a non-zero exit (actual audit failures, network errors) is swallowed; the workflow proceeds as if everything is fine. At minimum, capture and surface the exit code.
pnpm audit --fix=update is not a standard pnpm flag combination—pnpm audit doesn't accept --fix=update; the correct command is pnpm update after identifying vulnerable packages, or using pnpm audit --fix (pnpm ≥8). Verify the flag is valid for the targeted pnpm version.
Pinned action SHA actions/checkout@93cb6efe... is tagged v5.0.1 in the comment but the latest stable is v4; actions/setup-node comment says v6.0.0 but latest stable is v4. If these SHAs don't correspond to real releases the workflow will fail or run unintended code.
Only package.json and pnpm-lock.yaml are explicitly staged (git add). In a monorepo with workspace packages, sub-package package.json files won't be committed, producing an inconsistent lockfile commit.
No reviewer or assignee set on gh pr create; PRs may go unnoticed.

Security Hotspots

permissions: contents: write + pull-requests: write granted at workflow level with GITHUB_TOKEN. A compromised dependency update (supply-chain) could introduce malicious code that gets automatically committed and PR'd. Scope is as narrow as possible here, but the write-to-main-branch ability is inherently elevated.
git push --force with a bot token allows overwriting branch history; if branch protection is misconfigured, this could force-push onto protected branches if BRANCH_NAME ever matches one.

Changes

Changes

.github/workflows/pnpm-audit-fix.yml (new file)

Scheduled cron (Mondays 10:00 UTC) + workflow_dispatch trigger
Checks out repo, sets up pnpm + Node 24
Runs pnpm audit --fix=update
If lockfile changed: creates branch automated/pnpm-audit-fix, commits package.json/pnpm-lock.yaml, force-pushes, opens PR via gh pr create (idempotent via || echo)

sequenceDiagram
    participant Scheduler as GitHub Scheduler
    participant GHA as GitHub Actions Runner
    participant Repo as Repository
    participant GH as GitHub API (gh cli)

    Scheduler->>GHA: Trigger (cron / workflow_dispatch)
    GHA->>Repo: checkout
    GHA->>GHA: setup pnpm + Node 24
    GHA->>GHA: pnpm audit --fix=update
    GHA->>GHA: git diff --quiet?
    alt changes present
        GHA->>Repo: git checkout -b automated/pnpm-audit-fix
        GHA->>Repo: git add package.json pnpm-lock.yaml
        GHA->>Repo: git commit
        GHA->>Repo: git push --force origin automated/pnpm-audit-fix
        GHA->>GH: gh pr create (--base main)
        GH-->>GHA: PR URL or "already exists"
    else no changes
        GHA->>GHA: echo "No audit fixes needed" + exit 0
    end

github-actions · 2026-09-01T00:15:15Z

anthropic debug - [puLL-Merge] - brave/pull-merge@401

Diff

diff --git a/.github/workflows/pnpm-audit-fix.yml b/.github/workflows/pnpm-audit-fix.yml
new file mode 100644
index 0000000..58cc0cb
--- /dev/null
+++ .github/workflows/pnpm-audit-fix.yml
@@ -0,0 +1,72 @@
+name: pnpm audit fix
+
+on:
+  schedule:
+    # Run every Monday at 10:00 AM UTC (after model updates at 9:00)
+    - cron: '0 10 * * 1'
+  workflow_dispatch: # Allow manual triggering
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  audit-fix:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: '24.x'
+          cache: 'pnpm'
+
+      - name: Run pnpm audit fix
+        id: audit-fix
+        continue-on-error: true
+        run: pnpm audit --fix=update
+
+      - name: Check for changes and create PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if git diff --quiet; then
+            echo "No audit fixes needed"
+            exit 0
+          fi
+
+          # Configure git
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Create and switch to new branch
+          BRANCH_NAME="automated/pnpm-audit-fix"
+          git checkout -b "${BRANCH_NAME}"
+
+          # Commit changes
+          git add package.json pnpm-lock.yaml
+          if [ -f pnpm-workspace.yaml ]; then git add pnpm-workspace.yaml; fi
+          git commit -m "Fix pnpm audit vulnerabilities"
+
+          # Push branch
+          git push origin "${BRANCH_NAME}" --force
+
+          # Create PR (will fail gracefully if PR already exists)
+          gh pr create \
+            --title "Fix pnpm audit vulnerabilities" \
+            --body "This PR automatically fixes dependency audit vulnerabilities by running \`pnpm audit --fix=update\`.
+
+          ## Changes
+          - Updated \`pnpm-lock.yaml\` with security fixes
+
+          This PR was automatically generated by the \`pnpm-audit-fix\` workflow." \
+            --base main \
+            --head "${BRANCH_NAME}" \
+            --label dependencies \
+            --repo "${GITHUB_REPOSITORY}" || echo "PR already exists or could not be created"

Description

Adds scheduled GitHub Actions workflow (pnpm-audit-fix.yml) running weekly Mondays 10:00 UTC (plus manual dispatch) that executes pnpm audit --fix=update, commits changes to a fixed branch automated/pnpm-audit-fix, force-pushes, and opens a PR via gh.

Possible Issues

pnpm audit --fix=update — not a valid pnpm flag. pnpm supports bare --fix (writes pnpm.overrides into package.json). Value form is npm-ish. continue-on-error: true hides the failure, so workflow silently no-ops forever.
No pnpm install step. pnpm audit --fix only edits package.json overrides; lockfile isn't regenerated. PR body claims "Updated pnpm-lock.yaml with security fixes" — false, and resulting branch has inconsistent lock/manifest that will fail --frozen-lockfile CI.
No pnpm install also means audit runs without node_modules; fine for lockfile-based audit but confirm.
Force-push to a static branch discards review commits pushed by humans onto the open PR.
git diff --quiet runs before any staging and ignores untracked files; okay here, but exits 0 silently along with the masked audit failure — no signal that audit itself broke.
gh pr create ... || echo "PR already exists" swallows every error class (missing dependencies label, permission denied, base branch mismatch). Label must pre-exist or creation fails.
PRs created with secrets.GITHUB_TOKEN do not trigger pull_request workflows — audit-fix PRs will land without CI.
No concurrency group; manual dispatch during scheduled run can race on the same branch.
Hardcoded --base main; use ${{ github.event.repository.default_branch }}.
Comment "after model updates at 9:00" references a workflow not present in this diff.

Security Hotspots

permissions: contents: write + force-push on a scheduled job: bounded, but the job auto-applies dependency version bumps from registry data. If pnpm install gets added later, postinstall scripts from newly resolved versions execute with write token — pin with --ignore-scripts.

Changes

Changes

.github/workflows/pnpm-audit-fix.yml

New scheduled/dispatchable job: checkout, pnpm setup, Node 24, pnpm audit --fix=update, branch + commit + force push, gh pr create labeled dependencies.
Actions pinned by SHA — good.

sequenceDiagram
    participant Cron as Schedule/Dispatch
    participant Job as audit-fix job
    participant PNPM as pnpm audit
    participant Git as Repo
    participant GH as GitHub API (gh)

    Cron->>Job: trigger (Mon 10:00 UTC)
    Job->>Git: checkout main
    Job->>PNPM: pnpm audit --fix=update
    PNPM-->>Job: modified package.json (errors swallowed)
    Job->>Job: git diff --quiet?
    alt no changes
        Job-->>Cron: exit 0
    else changes
        Job->>Git: checkout -b automated/pnpm-audit-fix
        Job->>Git: commit package.json, pnpm-lock.yaml
        Job->>Git: push --force
        Job->>GH: gh pr create --base main --label dependencies
        GH-->>Job: PR created or error (ignored)
    end

ci: restore audit-fix workflow using pnpm

a6f8fbc

Weekly scheduled npm audit fix workflow was removed during the pnpm migration (7f03ed8), leaving PR #388 stale. Recreate it for pnpm: pnpm audit --fix=update updates the lockfile with security fixes, then opens a PR when it changes.

thypon mentioned this pull request Sep 1, 2026

Fix npm audit vulnerabilities #388

Closed

github-actions Bot added the puLL-Merge label Sep 1, 2026

Navigation Menu

Uh oh!

ci: restore audit-fix workflow using pnpm - #401

ci: restore audit-fix workflow using pnpm#401
thypon wants to merge 1 commit into
mainfrom
ci/pnpm-audit-fix

thypon commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Changes

Uh oh!

github-actions Bot commented Sep 1, 2026

Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

thypon commented Sep 1, 2026

Changes

Uh oh!

github-actions Bot commented Sep 1, 2026

Description

Possible Issues

Security Hotspots

Changes

Uh oh!

github-actions Bot commented Sep 1, 2026

Description

Possible Issues

Security Hotspots

Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant