fix(ci): audit every web workspace in shared gate

Author: ebursztein

.github/workflows/ci.yaml

@@ -14,6 +14,9 @@ permissions:
   contents: read
 
 jobs:
+  fast-gate:
+    uses: ./.github/workflows/fast-gate.yaml
+
   # ---------------------------------------------------------------------------
   # Linux: compile + test KVM hypervisor backend (cfg(target_os = "linux"))
   # ---------------------------------------------------------------------------
@@ -143,9 +146,6 @@ jobs:
       - name: Install release site dependencies
         run: cd release-site && pnpm install --frozen-lockfile
 
-      - name: Frontend dependency audit
-        run: python3 scripts/audit-pnpm-bulk.py --project-dir frontend
-
       - name: Install prebuilt Rust tools
         uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b
         with:
@@ -464,25 +464,28 @@ jobs:
   # ---------------------------------------------------------------------------
   pr-gate:
     runs-on: ubuntu-latest
-    needs: [test-linux, test, test-install, docs-build, site-build, release-site-build]
+    needs: [fast-gate, test-linux, test, test-install, docs-build, site-build, release-site-build]
     if: ${{ always() }}
     steps:
       - name: Require all CI jobs
         env:
+          FAST_GATE_RESULT: ${{ needs.fast-gate.result }}
           TEST_LINUX_RESULT: ${{ needs.test-linux.result }}
           TEST_MACOS_RESULT: ${{ needs.test.result }}
           TEST_INSTALL_RESULT: ${{ needs.test-install.result }}
           DOCS_BUILD_RESULT: ${{ needs.docs-build.result }}
           SITE_BUILD_RESULT: ${{ needs.site-build.result }}
           RELEASE_SITE_BUILD_RESULT: ${{ needs.release-site-build.result }}
         run: |
+          echo "fast-gate:    $FAST_GATE_RESULT"
           echo "test-linux:   $TEST_LINUX_RESULT"
           echo "test:         $TEST_MACOS_RESULT"
           echo "test-install: $TEST_INSTALL_RESULT"
           echo "docs-build:   $DOCS_BUILD_RESULT"
           echo "site-build:   $SITE_BUILD_RESULT"
           echo "release-site-build: $RELEASE_SITE_BUILD_RESULT"
 
+          test "$FAST_GATE_RESULT" = success
           test "$TEST_LINUX_RESULT" = success
           test "$TEST_MACOS_RESULT" = success
           test "$TEST_INSTALL_RESULT" = success

.github/workflows/fast-gate.yaml

@@ -44,7 +44,7 @@ jobs:
       - name: Install prebuilt Rust gate tools
         uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b
         with:
-          tool: cargo-audit@0.22.1,cargo-llvm-cov@0.8.5,b3sum@1.8.5,cargo-sbom,tauri-cli
+          tool: cargo-audit@0.22.1,cargo-llvm-cov@0.8.5,b3sum@1.8.5,cargo-sbom@0.10.0,tauri-cli@2.11.0
 
       - name: Run shared static module
         run: just _test-static

.github/workflows/security-audit.yaml

@@ -25,7 +25,11 @@ jobs:
         with:
           node-version: 24
           cache: pnpm
-          cache-dependency-path: frontend/pnpm-lock.yaml
+          cache-dependency-path: |
+            frontend/pnpm-lock.yaml
+            docs/pnpm-lock.yaml
+            site/pnpm-lock.yaml
+            release-site/pnpm-lock.yaml
 
       - uses: taiki-e/install-action@07b4745e0c39a41822af610387492e3e53aa222b
         with:
@@ -37,8 +41,11 @@ jobs:
       - name: RustSec audit (blocking security signal)
         run: cargo audit
 
-      - name: Install frontend dependencies
-        run: pnpm --dir frontend install --frozen-lockfile
+      - name: Install all web dependencies
+        run: |
+          for project in frontend docs site release-site; do
+            pnpm --dir "$project" install --frozen-lockfile
+          done
 
       - name: npm bulk advisory audit (blocking security signal)
-        run: python3 scripts/audit-pnpm-bulk.py --project-dir frontend
+        run: python3 scripts/audit-pnpm-bulk.py

CHANGELOG.md

@@ -12,8 +12,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Restored fail-closed release inputs and early gates: CI now caches
   manifest-selected native profile blobs by recorded digest, installed
   Doctor/Winterfell boots real assets with retained failure evidence, blocking
-  audits/Clippy/frontend checks run before builders, and the frontend uses its
-  checked-in semantic theme without a Preline dependency.
+  audits/Clippy/web checks run before builders, all JavaScript workspaces audit
+  clean, and the frontend uses its checked-in semantic theme without a Preline
+  dependency.
 
 ### Added
 

docs/astro.config.mjs

@@ -29,36 +29,36 @@ export default defineConfig({
         { slug: 'getting-started' },
         {
           label: 'Usage',
-          autogenerate: { directory: 'usage' },
+          items: [{ autogenerate: { directory: 'usage' } }],
         },
         {
           label: 'Architecture',
-          autogenerate: { directory: 'architecture' },
+          items: [{ autogenerate: { directory: 'architecture' } }],
         },
         {
           label: 'Security',
-          autogenerate: { directory: 'security' },
+          items: [{ autogenerate: { directory: 'security' } }],
         },
         {
           label: 'Benchmarks',
-          autogenerate: { directory: 'benchmarks' },
+          items: [{ autogenerate: { directory: 'benchmarks' } }],
         },
         {
           label: 'Debugging',
-          autogenerate: { directory: 'debugging' },
+          items: [{ autogenerate: { directory: 'debugging' } }],
         },
         {
           label: 'Gotchas / FAQ',
-          autogenerate: { directory: 'gotchas' },
+          items: [{ autogenerate: { directory: 'gotchas' } }],
         },
         {
           label: 'Development',
-          autogenerate: { directory: 'development' },
+          items: [{ autogenerate: { directory: 'development' } }],
         },
         {
           label: 'Releases',
           collapsed: true,
-          autogenerate: { directory: 'releases' },
+          items: [{ autogenerate: { directory: 'releases' } }],
         },
       ],
     }),

docs/package.json

@@ -8,13 +8,13 @@
     "preview": "astro preview"
   },
   "dependencies": {
-    "@astrojs/starlight": "^0.38.2",
+    "@astrojs/starlight": "^0.41.4",
     "@astrojs/starlight-tailwind": "^5.0.0",
-    "@tailwindcss/vite": "^4.0.0",
-    "astro": "^6.1.8",
-    "astro-mermaid": "^2.0.1",
-    "mermaid": "^11.13.0",
-    "sharp": "^0.34.5",
-    "tailwindcss": "^4.0.0"
+    "@tailwindcss/vite": "^4.3.3",
+    "astro": "^7.1.3",
+    "astro-mermaid": "^2.1.0",
+    "mermaid": "^11.16.0",
+    "sharp": "^0.35.3",
+    "tailwindcss": "^4.3.3"
   }
 }