move npm audit to CI from Dockerfile
#228
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pin to major version instead of patch version, ensures we get security fixes and the like on each build avoid calling `npm audit fix` in the image, which results in package-lock.json not being representative of what's in the image instead, `npm audit fix` should be called on the main repo and committed
so CI fails if there are vulnerabilities
Merged
If we want the docker image to represent our in-repo package-lock.json, we should ensure we install from package-lock.json, which I think we currently don't when we write I think then perhaps what we need is Also, since we run |
This was referenced May 29, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If this new test stage fails, running
npm audit fixand committing the result will fix it.Moves the fixes to the repo's package-lock.json, rather than deferring to the docker build. This means that all installs of CHP will get fixes, not just docker, and ensures that package-lock.json accurately represents what is installed in the image.
It also ensures that we are notified when a fix is needed.
The base image is also pinned only to the major node version to ensure that security patches are received on every build, rather than forcing us to keep bumping the base image.
This also reverts the removal of npm in #226, which didn't have any effect on the vulnerability of the image, but there may be some unfortunate policy reasons why it needs to be done, despite having no effect.