Skip to content

ci(hub): remove Bundler Audit check #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nshki merged 1 commit into from
Oct 23, 2026
Merged

ci(hub): remove Bundler Audit check #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 0 additions & 13 deletions .github/workflows/hub-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,19 +109,6 @@ jobs:
- run: bin/rails db:prepare
- run: bin/check-annotations

bundler_audit:
name: Bundler audit
needs: changes
if: ${{ needs.changes.outputs.hub == 'true' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
with:
bundler-cache: true
working-directory: hub
- run: bin/bundler-audit check --update

typecheck:
name: TypeScript types${{ matrix.node == 26 && ' (Node 26)' || '' }}
needs: changes
Expand Down
2 changes: 1 addition & 1 deletion docs/testing-and-review.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ Hub and the shared build action wait seven days before resolving newly published

Inside the Hub devcontainer, `bin/check-dependency-age` verifies the Hub npm and Bundler lockfiles. The repository-level [Dependency age workflow](../.github/workflows/dependency-age.yml) runs the same checker across Hub, the shared build action, and external GitHub Action commits. These checks cover existing lockfiles that bypass the package manager's resolver delay and fail when publication metadata is unavailable.

CI does not run `npm audit`: a newly published security fix could otherwise make the audit fail while the age check rejects the fixed version. Dependabot and Bundler Audit check dependencies for known vulnerabilities. Organization-managed CodeQL scans application code on GitHub.
GitHub CI does not run `npm audit` or Bundler Audit: a newly published security fix could otherwise make an audit fail while the age check rejects the fixed version. Dependabot checks dependencies for known vulnerabilities. Hub's local `bin/ci` still runs Bundler Audit. Organization-managed CodeQL scans application code on GitHub.

When a dependency is too new, select an older compatible version or wait until the seven-day window ends. See [Hub testing and operations](../hub/docs/testing-and-operations.md#update-dependencies) for Hub-specific tooling.

Expand Down
Loading