skatespots/SkateSpots
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

chore(deps): surface the OSV total + retry 3 days after a failed run

Browse source 
Notifications now include the OSV summary. A failed run restores the lockfile
and schedules a retry in ~3 days instead of consuming the full 20-day interval.
This commit is contained in:
SkateSpots 2026-10-26 12:01:12 +07:00
parent f88dfe79ab
commit f56a8b28e5
2 changed files with 17 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
AGENTS.md
View file

@ -2325,6 +2325,9 @@ Rules:
`book_new`/`aoa_to_sheet`/`writeFile`, no `read`, so the parse CVEs don't
apply). `zapstore.yaml` license was `custom` (the listing showed "custom");
now **`AGPL-3.0-only`** (re-published in 1.6.8, verified on the 32267 tag).
On **failure** the job restores the lockfile and schedules a retry in **~3 days**
(a failed run no longer burns the whole 20-day window); every notification now
includes the **OSV total** ("N packages affected by M known vulnerabilities").
### Community relay — self-hosted Newlay (2026-10-12)

20
scripts/update-deps.sh
View file

@ -76,8 +76,14 @@ fi
fi
} | tee "$REPORT"
# The OSV summary line (e.g. "Total 27 packages affected by 59 known ...") is the
# number worth surfacing in notifications; npm audit's counts are narrower.
OSV_SUMMARY="$(grep -E '^Total [0-9]+ packages affected' "$REPORT" | tail -1)"
[ -n "$OSV_SUMMARY" ] || OSV_SUMMARY="OSV scan: no summary (scanner missing?)"
if [ "$SCAN_ONLY" -eq 1 ]; then
log "scan-only; report: $REPORT"
echo "$OSV_SUMMARY"
exit 0
fi
@ -113,18 +119,18 @@ if npm test >"$STATE_DIR/test.log" 2>&1 && node scripts/smoke-test.mjs >"$STATE_
# Bound the push: the git remote signs via the remote signer and can stall.
if timeout 180 git push origin main >"$STATE_DIR/push.log" 2>&1; then
log "pushed dependency update"
notify "Dependency update applied, tests pass, pushed."
notify "Dependency update applied, tests pass, pushed. ${OSV_SUMMARY}"
else
log "push failed/skipped (see $STATE_DIR/push.log)"
notify "Dependency update committed locally but the push failed."
notify "Dependency update committed locally but the push failed. ${OSV_SUMMARY}"
fi
else
log "committed locally (--no-push)"
notify "Dependency update applied and committed locally."
notify "Dependency update applied and committed locally. ${OSV_SUMMARY}"
fi
else
log "no dependency changes to commit"
notify "Dependency scan complete: nothing to update."
notify "Dependency scan complete: nothing to update. ${OSV_SUMMARY}"
fi
finish_timer
log "done"
@ -133,7 +139,9 @@ else
cp "$STATE_DIR/package.json.bak" package.json 2>/dev/null || true
cp "$STATE_DIR/package-lock.json.bak" package-lock.json 2>/dev/null || true
npm i --silent >/dev/null 2>&1 || true
notify "Dependency update REVERTED — tests failed (see $STATE_DIR/test.log)."
finish_timer
# A failed run must NOT consume the whole interval: retry in ~3 days instead.
RETRY_DAYS=3; [ "$INTERVAL_DAYS" -gt 4 ] || RETRY_DAYS=1
echo $(( $(date +%s) - (INTERVAL_DAYS - RETRY_DAYS) * 86400 )) > "$LAST"
notify "Dependency update REVERTED — tests failed (see $STATE_DIR/test.log). ${OSV_SUMMARY}"
exit 1
fi