FrankChen021 commented on code in PR #20421:
URL: https://github.com/apache/druid/pull/20421#discussion_r4104464731
##########
.github/scripts/web-checks.sh:
##########
@@ -33,7 +33,7 @@ cd ..
# web console
mvn -B test -pl 'web-console'
cd web-console
-{ for i in 1 2 3; do npm run codecov && break || sleep 15; done }
+{ for i in 1 2 3; do npx --yes [email protected] --disable=gcov -p .. && break ||
sleep 15; done }
Review Comment:
[P2] CI bypasses the audited Codecov dependency tree
**Finding:** This new command downloads [email protected] with npx instead of
using the checked-in web-console dependency tree. [email protected] declares
[email protected] directly, while the previous lockfile applied the repository's
js-yaml@<4 pin to 3.15.0; the CI run therefore still executes the outdated
transitive dependency even though npm audit for web-console is now clean, so
the dependency-hardening change does not cover the uploader path.
**Suggestion:** Use a maintained uploader or invoke a dependency whose
complete patched transitive tree is checked in and audited, rather than
installing the legacy Codecov tree ad hoc with npx.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
