Uh oh!
There was an error while loading. Please reload this page.
chore: fix CI setup (aube relock) and clear high-severity audit advisories - #168
Conversation
aube audit --audit-level high (run by CI) reports 8 high advisories in transitive dev dependencies: brace-expansion (<5.0.9), js-yaml (<4.3.1), nanoid (<3.3.18), and postcss (<=8.5.17). Bump the existing overrides block to the fixed versions; each package resolves to a single version in the tree, so the bumps are mechanical.
ThomasK33
commented
Aug 21, 2026
@codex review |
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
The aube repository moved from endevco/aube to jdx/aube. GitHub attestation lookups via the old path now find nothing, so mise 2026.8.x fails 'mise install --locked' with 'Lockfile requires github-attestations provenance ... but verification was not performed', breaking every CI job at setup. Regenerate the aube lockfile entries with current mise (mise lock aube): URLs now point at jdx/aube and the unverifiable provenance pins are dropped. All artifact sha256 checksums are unchanged, so the pinned binaries are identical.
ThomasK33
commented
Aug 21, 2026
@codex review |
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Problem
Two independent trunk-health failures break every fresh CI run:
auberepository moved fromendevco/aubetojdx/aube. GitHub-attestation lookups via the old path now find nothing, somise install --locked(mise 2026.8.x, as installed byjdx/mise-action) aborts withLockfile requires github-attestations provenance for github:endevco/aube@1.10.4 but verification was not performed. Every job dies at "Set up mise" within seconds.mise run auditreports 8 high advisories in transitive dev dependencies:brace-expansion<5.0.9 (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895 — the existing override pin5.0.6is itself vulnerable),js-yaml<4.3.1 (GHSA-5p4m-2wfm-xmqj, GHSA-52cp-r559-cp3m),nanoid<3.3.18 (GHSA-2v37-7h3g-55p8, GHSA-28wg-ghj8-5hjv),postcss<=8.5.17 (GHSA-r28c-9q8g-f849).Mechanism
mise.lockwith current mise (mise lock aube): URLs now point atjdx/aubeand the unverifiableprovenance = "github-attestations"pins are dropped. All artifact sha256 checksums are unchanged, so the pinned binaries are byte-identical; the repo transfer was verified via the GitHub API (repos/endevco/aube→jdx/aube).overridesblock inpackage.json(brace-expansion 5.0.9, js-yaml 4.3.1, nanoid 3.3.18, postcss 8.5.18) and refreshaube-lock.yaml. Each package resolves to a single version in the tree, so the bumps are mechanical.How to verify
Validation run: reproduced the CI failure locally with mise 2026.8.10 and 2026.8.9 (isolated MISE_DATA_DIR/MISE_CACHE_DIR/MISE_STATE_DIR), confirmed the exact CI install command passes on both new (2026.8.10) and older (2026.5.12) mise after the relock;
mise run auditclean;npm run typecheck;npx vitest run test/unit(1355 passed).Note: this unblocks CI for all open PRs — until it merges, fresh CI runs on other branches fail at "Set up mise".
Generated with
mux• Model:anthropic:claude-fable-5• Thinking:xhigh