ci: enforce scoped production dependency audits

.github/production-audit-policy.json

@@ -0,0 +1,43 @@
+{
+  "auditLevel": "high",
+  "scope": "Production dependencies declared by each published package, resolved in isolated consumer manifests without monorepo overrides",
+  "acceptedAdvisories": [
+    {
+      "id": "GHSA-xcpc-8h2w-3j85",
+      "package": "adm-zip",
+      "severity": "high",
+      "affectedArtifacts": [
+        "@cortexkit/opencode-magic-context",
+        "@cortexkit/pi-magic-context"
+      ],
+      "dependencyPath": "@huggingface/transformers@4.2.0 > onnxruntime-node@1.24.3 > adm-zip@0.5.18",
+      "reachability": "onnxruntime-node uses adm-zip only during native-provider installation; runtime inference does not parse ZIP input",
+      "owner": "cortexkit/magic-context maintainers",
+      "rationale": "No released onnxruntime-node version permits patched adm-zip@0.6.x; acceptance is temporary pending the upstream range change and coordinated Transformers release",
+      "expires": "2026-11-17",
+      "upstream": [
+        "https://github.com/huggingface/transformers.js/issues/1727",
+        "https://github.com/microsoft/onnxruntime/pull/29772",
+        "https://github.com/huggingface/transformers.js/pull/1731"
+      ]
+    },
+    {
+      "id": "GHSA-f88m-g3jw-g9cj",
+      "package": "sharp",
+      "severity": "high",
+      "affectedArtifacts": [
+        "@cortexkit/opencode-magic-context",
+        "@cortexkit/pi-magic-context"
+      ],
+      "dependencyPath": "@huggingface/transformers@4.2.0 > sharp@0.34.5",
+      "reachability": "Magic Context uses the Transformers text-embedding pipeline and does not pass image input to sharp",
+      "owner": "cortexkit/magic-context maintainers",
+      "rationale": "Transformers' released ^0.34.5 range cannot select patched sharp@0.35.x; acceptance is temporary pending the upstream range change and release",
+      "expires": "2026-11-17",
+      "upstream": [
+        "https://github.com/huggingface/transformers.js/issues/1729",
+        "https://github.com/huggingface/transformers.js/pull/1731"
+      ]
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -7,6 +7,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  BUN_VERSION: "1.3.10"
 
 # Pipeline shape on every push to master and on every PR:
 #
@@ -28,6 +29,22 @@ env:
 # every PR and master push exercises the full unit → Docker → host gauntlet.
 
 jobs:
+  audit-production:
+    name: Audit (published production dependencies)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Test production audit policy
+        run: bun run test:audit-production
+
+      - name: Reject unaccepted HIGH production advisories
+        run: bun run audit:production
+
   check-plugin:
     name: Check (plugin)
     runs-on: ubuntu-latest
@@ -36,7 +53,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       # node:sqlite (the Pi / OpenCode-Desktop SQLite backend) is only reachable
       # under Node, not Bun. Node 24 also strips the smoke script's inline TS.
@@ -104,7 +121,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -129,7 +146,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -160,7 +177,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install workspace deps
         run: bun install --frozen-lockfile
@@ -193,7 +210,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install workspace deps
         run: bun install --frozen-lockfile
@@ -230,7 +247,7 @@ jobs:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install workspace deps
         run: bun install --frozen-lockfile
@@ -266,7 +283,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       - name: Install workspace deps
         run: bun install --frozen-lockfile
@@ -328,7 +345,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: ${{ env.BUN_VERSION }}
 
       # Pi tests resolve the Pi binary via createRequire against
       # @earendil-works/pi-coding-agent, which is a workspace dep of

.github/workflows/release.yml

@@ -11,10 +11,11 @@ permissions:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  BUN_VERSION: "1.3.10"
 
 # Pipeline shape (each stage gates the next via `needs:`):
 #
-#   test, test-pi, test-cli                                (unit tests, parallel)
+#   audit-production, test, test-pi, test-cli              (policy/audit + unit tests, parallel)
 #                  ↓
 #   e2e-opencode, e2e-pi                                   (Docker install + smoke, parallel — gated by unit tests)
 #                  ↓
@@ -47,6 +48,22 @@ env:
 # (workflow_dispatch only) for re-announcements and external releases.
 
 jobs:
+  audit-production:
+    name: Audit (published production dependencies)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: ${{ env.BUN_VERSION }}
+
+      - name: Test production audit policy
+        run: bun run test:audit-production
+
+      - name: Reject unaccepted HIGH production advisories
+        run: bun run audit:production
+
   test:
     name: Test (plugin)
     runs-on: ubuntu-latest
@@ -329,7 +346,7 @@ jobs:
     # Publishes are gated on the full e2e suite (OpenCode + Pi) so a tag
     # push can never produce a published npm package whose runtime fails
     # the install + first-turn smoke test.
-    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi]
+    needs: [audit-production, test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi]
     steps:
       - uses: actions/checkout@v5
 
@@ -368,7 +385,7 @@ jobs:
   publish-npm-pi:
     name: Publish pi-plugin to npm
     runs-on: ubuntu-latest
-    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi]
+    needs: [audit-production, test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi]
     steps:
       - uses: actions/checkout@v5
 
@@ -402,7 +419,7 @@ jobs:
   publish-npm-cli:
     name: Publish unified CLI to npm
     runs-on: ubuntu-latest
-    needs: [test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi]
+    needs: [audit-production, test, test-pi, test-cli, e2e-opencode, e2e-pi, e2e-host-opencode, e2e-host-pi]
     steps:
       - uses: actions/checkout@v5
 

package.json

@@ -17,6 +17,8 @@
     "test:rust": "cargo test --workspace",
     "lint:rust": "cargo fmt --check && cargo clippy --workspace --all-targets -- -D warnings",
     "fmt:rust": "cargo fmt",
+    "audit:production": "bash scripts/audit-production.sh",
+    "test:audit-production": "bun test scripts/audit-production.test.ts",
     "check:all": "bun run test && cargo test --workspace && cargo clippy --workspace --all-targets -- -D warnings",
     "build:dists": "bun run --cwd packages/plugin build && bun run --cwd packages/pi-plugin build"
   }