Nightly checks need attention

[github-actions]

Updated by the nightly workflow — 2026-09-09T07:49:59.356Z.

Failed jobs

• secrets — failure

Dependency advisories

None at --audit-level=high for production dependencies.

Advisories alone never fail the workflow; a failed job does. Close this issue once triaged — the next bad night opens a fresh one.

[ChanMeng666]

Both halves of this issue are addressed on main. Recording what was measured, because the summary this was being worked from was wrong in two places.

The failing job was secrets, not the dependency audit

This issue's own body said so correctly (secrets — failure); the backlog entry that tracked it did not, and had people looking at the audit. Dependency audit (report-only) passes and, being report-only, cannot fail the night.

Three gitleaks findings, all verified false positives, all in paper/experiments/ecosystem/results-2026-08-22.json at ba3bbc4c, all matched by sourcegraph-access-token — a rule that fires on a bare 40-character hex run, and a git commit SHA is one:

line	content	what it actually is
119236 / 119237	uses: memi-design/memi@74fc6ce8… # v2.7.7	a third party's workflow diff, captured by the ecosystem census — SHA-pinned Action references, i.e. the recommended supply-chain practice
254081	"revision": "c74576c4…"	a public npm package's git revision, read out of its own metadata

All three are other people's public commit SHAs. None is a credential and none was ever ours. They cannot be deleted either: paper/ moved to a private repository on 2026-08-26, and gitleaks scans the full history.

Fixed by a new .gitleaksignore that allowlists them by commit-pinned fingerprint (<commit>:<path>:<rule>:<line>), so an entry cannot suppress anything else — not even a real secret on the next line of the same file. Verified rather than assumed: 648 commits scanned → 0 findings, and removing one fingerprint makes exactly that one reappear.

Worth recording: the first draft of that file quoted the SHAs in full and therefore tripped the very rule it exists to quiet, which would have turned this job red again on the commit that added it. Found by running gitleaks, not by reading the file. The SHAs in its prose are truncated on purpose and the file says so.

The reason this mattered enough to fix rather than mute: a permanently red gate is a disabled gate that still costs CI minutes. Left alone it would have failed every night forever over three public SHAs, training every reader to scroll past the job where a real finding would eventually appear.

Dependency advisories: this issue's own audit is now clean

The count was also stale — 6 advisories across 2 roots had become 19 across a dozen. Twelve transitive roots were cleared with a plain npm audit fix (never --force), lockfile-only, no manifest change, every move a patch or minor: @hono/node-server, brace-expansion, dompurify, fast-uri, hono, ip-address, js-yaml, linkify-it, nanoid, postcss, qs, undici.

npm audit                       19 → 7   (2 critical, 1 high, 4 moderate)
npm audit --omit=dev --audit-level=high   exit 0, found 0 vulnerabilities

That second line is the command this issue's dependency section runs, so it should now report nothing.

All seven residuals are dev-only and are recorded in docs/backlog.md 3.1 with why each stays. The vitest 5 major is deliberately deferred with four written triggers: it is a three-major jump (2.1.9 → 5.0.0) across 203 test files and four workspaces, it does not clear esbuild (that advisory has two nodes and the one fixAvailable does not name is tsup's esbuild@0.27.7, which tsup@8.5.1 cannot reach), and it splits the vite tree vitepress currently shares. Neither critical ships — both are the test runner, and the vitest one is against the --ui server, which nothing here starts.

Also fixed while here: dependabot #79 and #80 could never have gone green individually, because codeql-action/init and analyze must be pinned to the same version and were filed as separate PRs. Both bumped in one commit.

No output byte moved across any of this: describe(), lint() and every storey's SVG across all 30 shipped examples — 95 artifacts — are SHA-256 identical before and after, on a sweep proved able to fail first.