Repository navigation
Commit 0771c7a
CI: Cover the AI development lockfile with Dependabot instead of npm audit (#83997)
* CI: Audit AI development test dependencies only when they change
The AI development tests keep their own lockfile, and nothing in it ships.
Auditing it on every pull request meant each new advisory failed every
unrelated pull request until someone landed a lockfile bump.
Move the audit into its own workflow that runs when that package.json or
lockfile changes, on a weekly schedule, and on demand. It still audits
optional dependencies, which `npm ci` installs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNq1QTiMxNePHbfKeFCqHp
* CI: Drop the separate AI development audit workflow
No other lockfile in the repository is audited in CI; the root lockfile,
which ships, relies on Dependabot alerts and security updates. Those
already cover test/ai-development/package-lock.json, so match that rather
than keeping a gate only this lockfile has.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNq1QTiMxNePHbfKeFCqHp
* CI: Run the AI development tests only when the harness can change
The eval harness's unit tests and config validation ran on every pull
request across three operating systems, though they only depend on
test/ai-development, tools/agents and .agents/skills. Move the job into
its own workflow scoped to those paths, as vitest-consumers.yml does for
the public test tooling. The job is not a required check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNq1QTiMxNePHbfKeFCqHp
* CI: Cover the AI development lockfile with Dependabot instead of npm audit
Narrow this change to how Gutenberg already handles dependency
advisories. Keep the AI development tests in static-checks.yml as they
were, minus the audit step, and give test/ai-development the same
security-updates-only Dependabot entry the root lockfile has.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNq1QTiMxNePHbfKeFCqHp
* Dependabot: Set a cooldown on the AI development npm entry
Clears zizmor's dependabot-cooldown warning on the new entry. The
cooldown applies only to version updates, which this entry disables, so
security updates are unaffected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNq1QTiMxNePHbfKeFCqHp
* Dependabot: Match the root npm entry exactly
Drop the cooldown so the AI development entry follows the existing npm
entry for the root lockfile, which has none.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KNq1QTiMxNePHbfKeFCqHp
---------
Co-authored-by: jeryj <jeryj@git.wordpress.org>
Co-authored-by: ciampo <mciampini@git.wordpress.org>1 parent a2660ae commit 0771c7a
2 files changed
Lines changed: 11 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
33 | 33 | | |
34 | 34 | | |
35 | 35 | | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
177 | 177 | | |
178 | 178 | | |
179 | 179 | | |
180 | | - | |
181 | | - | |
182 | | - | |
183 | | - | |
184 | 180 | | |
185 | 181 | | |
186 | 182 | | |
| |||
0 commit comments