ci(security): execute lint and dependency audit on PRs

[reprewindai-dev]

Advances #54 with a narrow repository-gate correction only.

Current cAPI PR CI runs npm ci, npm test, and npm run build, but does not execute the repository's existing npm run lint script or a dependency vulnerability gate. This PR adds both to the existing cAPI CI workflow:

• npm run lint
• npm audit --audit-level=high

No runtime code, port, deployment, MCP transport, or authority behavior is changed.

Truth boundary:

• passing this PR would improve source/CI evidence only;
• it does not establish deployed cAPI runtime 3003;
• secret scanning/CodeQL coverage from ci(security): add executable lint/dependency/security PR gates #54 remains separate until an executable repository-compatible gate is added and proven;
• cAPI must still be verified first after restart before downstream Gnomledger/runtime claims.

Keep draft until the exact-head workflow executes and all newly exposed baseline failures are corrected rather than suppressed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
c-api	Error		Aug 29, 2026 8:17pm
veklom-id-59uw	Error		Aug 29, 2026 8:17pm

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
auto_review:
drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[reprewindai-dev]

Exact-head CI run 33228436200 executed on a real GitHub-hosted runner and failed at the newly enabled lint gate before test/audit/build. This is not a source lint finding yet: the repository's existing lint script is next lint, while the PR/base dependency line is Next ^16.3.0; the command is being parsed as a project directory and fails with Invalid project directory provided .../lint. Current main has the same script/dependency mismatch, so classify this as an existing CI/tooling baseline defect exposed by #55, not a #55 runtime regression. Do not suppress or remove the lint gate. Repair the lint contract compatibly (ESLint CLI + supported Next/ESLint configuration/version line), then rerun exact-head lint/test/audit/build. Also note npm ci reported peer-resolution warnings because root eslint@^10 exceeds several eslint-config-next@16.2.x plugin peer ranges (max ESLint 9), so the repair should reconcile that version mismatch instead of papering over it. Runtime 3003 remains NOT_VERIFIED.

[reprewindai-dev]

CI reconciliation: the first executable lint failure was a Next 16 tooling mismatch (next lint is no longer the supported lint command), not evidence that the security gate should be removed. I updated this branch to use the direct ESLint CLI and added a Next 16 flat config while preserving npm audit --audit-level=high. New exact head: 71ba4b1b37d57ede230c90485eb9f6ff32d73a99. Fresh workflow run 33233282961 is now executing on a real GitHub-hosted runner. Keep draft until lint → tests → dependency audit → build all complete; any dependency/ESLint compatibility defect exposed by that run should be repaired rather than bypassed.

[reprewindai-dev]

Follow-up on exact-head run 33233282961: npm ci passed and the direct ESLint gate now genuinely executed, but lint still failed; because the workflow was sequential, tests/audit/build were skipped again. I split the four verification concerns into independent jobs at head 1d7b0d403060d8f8c1d84b910093b68a55944c5c so a lint baseline cannot hide test, dependency-audit, or build evidence. This does not weaken any gate: all four remain required evidence before this draft can advance.

[reprewindai-dev]

Exact-head reconciliation for 1d7b0d403060d8f8c1d84b910093b68a55944c5c: GitHub-hosted run 33233316284 is complete. Independent results are test PASS, dependency-audit PASS, build PASS, lint FAIL. This is stronger evidence than the prior sequential workflow because lint no longer masks the other gates. The lint check reports 2 annotations; the current connector can read the annotation count but cannot retrieve the annotation payload/log endpoint, so I am not guessing at source fixes or suppressing rules. Keep this PR draft until the concrete lint diagnostics are retrieved and corrected, then rerun the exact head. This remains source/CI evidence only; cAPI runtime 3003 is still NOT_VERIFIED.

[reprewindai-dev]

Exact-head lint failure is now log-resolved, not inferred from annotation count.

Run 33233316284 / lint job 99049812261 installs root eslint@10.7.0 and emits peer-resolution warnings from the Next 16 lint stack: eslint-plugin-import@2.32.0, eslint-plugin-jsx-a11y@6.10.2, and eslint-plugin-react@7.37.5 declare ESLint support through 9.x. npm run lint then executes eslint . and crashes before source diagnostics with TypeError: scopeManager.addGlobals is not a function under ESLint 10.7.0.

Classification: TOOLCHAIN_INCOMPATIBILITY, not a source lint pass/fail. Test, dependency-audit, and build jobs on the same head passed independently.

Required correction: align root ESLint and lockfile with the supported Next 16 plugin line (9.x; npm identified 9.39.5 as the compatible peer candidate), then rerun lint on a clean npm ci. Do not suppress lint rules or treat the current crash as green. Because npm ci requires package/lock agreement, change package.json and package-lock.json together rather than editing only the manifest.

Runtime truth remains unchanged: cAPI reported port 3003 is NOT_VERIFIED until deployed SHA + HTTP/protocol identity + listener + Traefik agree.

[reprewindai-dev]

Fresh exact-head result after commit 2f4a3194f74d0eb426bec061a6d6ca65ee680ec3:

• test: PASS
• dependency-audit: PASS
• build: PASS
• lint: FAIL
• aggregate protected-context verify: FAIL, as intended because it now depends on all four gates

This follow-up closes a merge-control defect in the PR itself: canonical main now requires status context verify, while the previous #55 workflow deleted that job name when splitting CI. The updated workflow preserves verify as the fail-closed aggregate, so branch protection cannot be orphaned by this PR.

The remaining lint failure is still the existing toolchain incompatibility: eslint@10.7.0 is outside the peer ranges used by eslint-config-next's bundled plugins, and eslint . crashes with TypeError: scopeManager.addGlobals is not a function. Do not merge or suppress the gate. Align the declared ESLint/Next lint toolchain in a reproducible lockfile-backed change, then rerun this exact aggregate contract.

[reprewindai-dev]

Exact-head CI diagnosis for 2f4a3194f74d0eb426bec061a6d6ca65ee680ec3 / run 33273042428:

• npm ci: PASS
• npm test: PASS
• npm run build: PASS
• npm audit --audit-level=high: PASS (0 vulnerabilities in this run)
• npm run lint: FAIL
• aggregate verify: FAIL as intended because lint failed

The lint failure is a toolchain compatibility failure, not application lint findings: ESLint is 10.7.0, while eslint-config-next@16.2.10 brings plugins that declare ESLint support through v9. The job reports peer-resolution warnings and then crashes with TypeError: scopeManager.addGlobals is not a function before producing normal lint diagnostics.

Do not suppress the lint gate or mark this PR green. Reconcile the ESLint/Next lint dependency set to a mutually supported version (including the lockfile), then rerun the exact head. Keep runtime 3003 NOT_VERIFIED; this CI result is source/security-gate evidence only and does not establish listener/HTTP/protocol/Traefik identity.

[reprewindai-dev]

Fresh source-of-truth check: this PR is still based on 8d6a692ecae8d239692f9b0bbb091854da6c3372, while current main is 7689d5213b74b60d42bbbb3304d563f8752952c0 and adds fail-closed integration-authority outage handling plus stale-authority replay regressions. Before merge, rebase/refresh this CI-gate branch onto current main and rerun the exact-head workflow. Preserve the existing lint/dependency-audit objective, but do not treat the old-base results as sufficient evidence for the current default-branch tree. Runtime 3003 remains NOT_VERIFIED; this is source/CI evidence only.

[reprewindai-dev]

Exact-head diagnosis for 2f4a3194f74d0eb426bec061a6d6ca65ee680ec3: the new lint gate is correctly exposing a dependency compatibility failure, not a source-style failure. npm ci installs eslint@10.7.0, while the eslint-config-next@16.2.10 plugin stack declares peer support only through ESLint 9; npm run lint then aborts with TypeError: scopeManager.addGlobals is not a function. Test, dependency-audit, and build jobs pass; verify fails only because lint fails. Do not suppress or allow-failure this gate. Repair by making the repository's ESLint / Next lint stack mutually compatible and regenerating the lockfile with the package manager, then rerun exact-head npm ci, npm run lint, tests, audit, and build. This remains source/CI evidence only; cAPI runtime 3003 remains NOT_VERIFIED.