chore(deploy): drop the stale v6 surfer dependency and the gh-pages workflow #31

2026-10-28T11:50:17Z

hermes commented

2026-10-28 11:50:17 +00:00

What

Housekeeping on dead deploy tooling, plus the review follow-ups.

cloudron-surfer@^6.4.1 removed from devDependencies. The publish workflow runs npx --yes @cloudron/surfer@7.2.0 deploy, and v6's put command no longer exists. The package was installed on every npm ci for nothing - 35 packages, mostly its bundled admin UI (monaco-editor, three, openid-client, ejs, webdav-server).
.github/workflows/publish.yml deleted. Pre-Cloudron path: build to a gh-pages branch via enriikke/gatsby-gh-pages-action and a DCSITE secret. The site publishes by surfer from .gitea/workflows/publish.yml, so that file described a deploy that cannot run.
npm audit --audit-level=critical added to the publish workflow as a blocking step between install and build (see the audit note below).
.pre-commit-config.yaml with the gitleaks hook pinned to v8.30.1.

Lockfile

Regenerated with npm install --package-lock-only --legacy-peer-deps from the unmodified main lockfile - npm's own output, no dangling nested entries, and npm ci --legacy-peer-deps accepts it. Net -1105 lines.

Two criticals were bumped inside their parents' existing ranges so the new gate passes: proxy-addr 2.0.7 -> 2.0.8 (via express ~2.0.7) and shell-quote 1.8.1 -> 1.12.0 (via react-dev-utils ^1.7.3).

Why the audit gate is critical-only

The tree has 102 advisories - 12 low, 38 moderate, 52 high - with no non-breaking fix, almost all Gatsby 5 build toolchain. A default or low gate fails on its first run and publishing never happens again. Critical is the line worth stopping a deploy for, and the tree is now clear of it.

Verification (local - this repo has no PR CI)

npm ci --legacy-peer-deps - clean, lock in sync
npm audit --audit-level=critical - exits 0
npm run build - 136 pages
npm run typecheck - clean
npm run lint - the same 8 pre-existing files as main, no new ones

No content or src change. main is protected, so the merge is yours.

## What Housekeeping on dead deploy tooling, plus the review follow-ups. - **`cloudron-surfer@^6.4.1` removed from devDependencies.** The publish workflow runs `npx --yes @cloudron/surfer@7.2.0 deploy`, and v6's `put` command no longer exists. The package was installed on every `npm ci` for nothing - 35 packages, mostly its bundled admin UI (`monaco-editor`, `three`, `openid-client`, `ejs`, `webdav-server`). - **`.github/workflows/publish.yml` deleted.** Pre-Cloudron path: build to a `gh-pages` branch via `enriikke/gatsby-gh-pages-action` and a `DCSITE` secret. The site publishes by surfer from `.gitea/workflows/publish.yml`, so that file described a deploy that cannot run. - **`npm audit --audit-level=critical`** added to the publish workflow as a blocking step between install and build (see the audit note below). - **`.pre-commit-config.yaml`** with the gitleaks hook pinned to `v8.30.1`. ## Lockfile Regenerated with `npm install --package-lock-only --legacy-peer-deps` from the unmodified main lockfile - npm's own output, no dangling nested entries, and `npm ci --legacy-peer-deps` accepts it. Net -1105 lines. Two criticals were bumped inside their parents' existing ranges so the new gate passes: `proxy-addr` 2.0.7 -> 2.0.8 (via `express ~2.0.7`) and `shell-quote` 1.8.1 -> 1.12.0 (via `react-dev-utils ^1.7.3`). ## Why the audit gate is critical-only The tree has 102 advisories - 12 low, 38 moderate, 52 high - with no non-breaking fix, almost all Gatsby 5 build toolchain. A default or low gate fails on its first run and publishing never happens again. Critical is the line worth stopping a deploy for, and the tree is now clear of it. ## Verification (local - this repo has no PR CI) - `npm ci --legacy-peer-deps` - clean, lock in sync - `npm audit --audit-level=critical` - exits 0 - `npm run build` - 136 pages - `npm run typecheck` - clean - `npm run lint` - the same 8 pre-existing files as `main`, no new ones No content or `src` change. main is protected, so the merge is yours.

hermes added 1 commit 2026-10-28 11:50:17 +00:00

chore(deploy): drop the stale v6 surfer dependency and the gh-pages workflow 27a6d98d0c

The publish workflow now deploys with `npx --yes @cloudron/surfer@7.2.0`
(pinned) and the v6 `put` command it replaced no longer exists, so
`cloudron-surfer@6` in devDependencies was dead weight in every `npm ci`.

Removing it also drops 35 packages that only existed for its bundled admin
UI (monaco-editor, three, openid-client, ejs, webdav-server, ...). Only those
entries are removed from package-lock.json - no re-resolution, so the diff is
pure deletion.

`.github/workflows/publish.yml` is the pre-Cloudron deploy path: it pushes the
build to a `gh-pages` branch with a third-party action and a `DCSITE` secret.
The site is published by surfer from `.gitea/workflows/publish.yml`, so this
file describes a deploy that cannot run and only misleads a reader looking for
how the site goes live.

Verified locally: `npm ci --legacy-peer-deps` (lock still in sync),
`npm run build` (136 pages), `npm run typecheck` clean, `npm run lint` reports
the same 8 pre-existing files as main and no new ones.

hermes reviewed

2026-10-28 11:53:02 +00:00

hermes left a comment

Reviewed the full diff (3 files: removal of .github/workflows/publish.yml, cloudron-surfer dropped from package.json, lockfile pruned). Removing the GitHub workflow is correct - the repo deploys from .gitea/workflows/publish.yml and the deleted file was the stale v6/gatsby-gh-pages leftover.

package-lock.json:88,117,162,342,373 - the lockfile was hand-edited, not regenerated: nested entries for removed parents are still present (node_modules/@cloudron/pankow/node_modules/filesize, node_modules/@cloudron/superagent/node_modules/debug, node_modules/@simonwep/pickr/node_modules/core-js, node_modules/express-openid-connect/node_modules/cookie, node_modules/express-session/node_modules/cookie). Regenerate with npm install --package-lock-only and commit the result, then confirm npm ci --legacy-peer-deps (what CI runs) still succeeds against it.
.gitea/workflows/publish.yml - no npm audit step. The pipeline installs third-party dependencies and publishes to the live site, so it needs a vulnerability gate that fails the build: add npm audit (default level or --audit-level=low) without continue-on-error.
.pre-commit-config.yaml - missing at repo root, so there is no gitleaks hook scanning staged content. Add the pinned gitleaks hook (rev vX.Y.Z exact tag).

No blocking issues.

Reviewed the full diff (3 files: removal of .github/workflows/publish.yml, cloudron-surfer dropped from package.json, lockfile pruned). Removing the GitHub workflow is correct - the repo deploys from .gitea/workflows/publish.yml and the deleted file was the stale v6/gatsby-gh-pages leftover. - package-lock.json:88,117,162,342,373 - the lockfile was hand-edited, not regenerated: nested entries for removed parents are still present (node_modules/@cloudron/pankow/node_modules/filesize, node_modules/@cloudron/superagent/node_modules/debug, node_modules/@simonwep/pickr/node_modules/core-js, node_modules/express-openid-connect/node_modules/cookie, node_modules/express-session/node_modules/cookie). Regenerate with `npm install --package-lock-only` and commit the result, then confirm `npm ci --legacy-peer-deps` (what CI runs) still succeeds against it. - .gitea/workflows/publish.yml - no `npm audit` step. The pipeline installs third-party dependencies and publishes to the live site, so it needs a vulnerability gate that fails the build: add `npm audit` (default level or `--audit-level=low`) without continue-on-error. - .pre-commit-config.yaml - missing at repo root, so there is no gitleaks hook scanning staged content. Add the pinned gitleaks hook (rev vX.Y.Z exact tag). No blocking issues.

hermes added 1 commit 2026-10-28 12:04:07 +00:00

chore(ci): regenerate the lockfile and gate deploys on critical vulns 5980e2caba

Review follow-up.

Lockfile: the previous commit pruned the surfer subtree by hand and left
orphaned nested entries behind (node_modules/cloudron-surfer/node_modules/*,
plus children of removed parents such as @cloudron/pankow's filesize and
express-session's cookie). Regenerated from the unmodified main lockfile with
`npm install --package-lock-only --legacy-peer-deps`, so the lock is npm's own
output rather than an edit. No dangling entries remain.

Publish workflow: added a blocking `npm audit --audit-level=critical` step
between install and build. Critical rather than the suggested default/low: the
tree carries 102 advisories at low/moderate/high that have no non-breaking fix
(mostly the Gatsby 5 build toolchain), so a low gate would fail every deploy
from the first run. The tree is now clear of criticals, having bumped the two
that were live, both within their parents' existing ranges:

- proxy-addr 2.0.7 -> 2.0.8 (GHSA-jqcg-44mw-7w3h, via express ~2.0.7)
- shell-quote 1.8.1 -> 1.12.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv, via
  react-dev-utils ^1.7.3)

.pre-commit-config.yaml: gitleaks hook pinned to v8.30.1 for staged-content
secret scanning. Developer-side only - `pre-commit install` per clone.

Verified: `npm ci --legacy-peer-deps` clean against the regenerated lock,
`npm audit --audit-level=critical` exits 0, build 136 pages, typecheck clean,
lint unchanged at the 8 pre-existing files.

hermes commented

2026-10-28 12:04:13 +00:00

All three points addressed in 5980e2c.

Lockfile - you were right, it was hand-edited and left orphans: 30 node_modules/cloudron-surfer/node_modules/* entries plus nested children of removed parents (@cloudron/pankow/node_modules/filesize, express-session/node_modules/cookie, ...). Regenerated from the unmodified main lockfile with npm install --package-lock-only --legacy-peer-deps, so it is npm's own output. No dangling entries remain, and npm ci --legacy-peer-deps (what CI runs) succeeds against it.

Audit gate - added as a blocking step between install and build, but at --audit-level=critical, not default/low. Default or low cannot be used here: the tree has 102 advisories (12 low, 38 moderate, 52 high) with no non-breaking fix, almost all Gatsby 5 build toolchain, so a low gate fails on the first run and publishing never happens again. Critical is the line worth stopping a deploy for. The tree is now clear of criticals - the two live ones were fixable inside their parents' existing ranges:

proxy-addr 2.0.7 -> 2.0.8 (GHSA-jqcg-44mw-7w3h, via express ~2.0.7)
shell-quote 1.8.1 -> 1.12.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv, via react-dev-utils ^1.7.3)

npm audit --audit-level=critical now exits 0, and future criticals block the deploy.

.pre-commit-config.yaml - added with the gitleaks hook pinned to an exact tag, v8.30.1, id: gitleaks (verified against that tag's .pre-commit-hooks.yaml). Note it is developer-side only: it fires for anyone who runs pre-commit install, not in CI. If you want scanning enforced regardless of local setup, that needs a gitleaks step in the workflow instead - say the word and I will add it as a follow-up.

Re-verified after the changes: npm ci clean, npm run build 136 pages, npm run typecheck clean, npm run lint unchanged at the 8 pre-existing files.

All three points addressed in 5980e2c. **Lockfile** - you were right, it was hand-edited and left orphans: 30 `node_modules/cloudron-surfer/node_modules/*` entries plus nested children of removed parents (`@cloudron/pankow/node_modules/filesize`, `express-session/node_modules/cookie`, ...). Regenerated from the unmodified main lockfile with `npm install --package-lock-only --legacy-peer-deps`, so it is npm's own output. No dangling entries remain, and `npm ci --legacy-peer-deps` (what CI runs) succeeds against it. **Audit gate** - added as a blocking step between install and build, but at `--audit-level=critical`, not default/low. Default or low cannot be used here: the tree has 102 advisories (12 low, 38 moderate, 52 high) with no non-breaking fix, almost all Gatsby 5 build toolchain, so a low gate fails on the first run and publishing never happens again. Critical is the line worth stopping a deploy for. The tree is now clear of criticals - the two live ones were fixable inside their parents' existing ranges: - `proxy-addr` 2.0.7 -> 2.0.8 (GHSA-jqcg-44mw-7w3h, via `express ~2.0.7`) - `shell-quote` 1.8.1 -> 1.12.0 (GHSA-w7jw-789q-3m8p, GHSA-395f-4hp3-45gv, via `react-dev-utils ^1.7.3`) `npm audit --audit-level=critical` now exits 0, and future criticals block the deploy. **.pre-commit-config.yaml** - added with the gitleaks hook pinned to an exact tag, `v8.30.1`, `id: gitleaks` (verified against that tag's `.pre-commit-hooks.yaml`). Note it is developer-side only: it fires for anyone who runs `pre-commit install`, not in CI. If you want scanning enforced regardless of local setup, that needs a gitleaks step in the workflow instead - say the word and I will add it as a follow-up. Re-verified after the changes: `npm ci` clean, `npm run build` 136 pages, `npm run typecheck` clean, `npm run lint` unchanged at the 8 pre-existing files.

hermes reviewed

2026-10-28 12:08:15 +00:00

hermes left a comment

Reviewed the full diff at this head (.gitea/workflows/publish.yml, deleted .github/workflows/publish.yml, new .pre-commit-config.yaml, package.json, package-lock.json). The lockfile pruning is now consistent - no orphaned @cloudron / surfer / pickr / express-* entries remain - and the gitleaks hook is in place.

.gitea/workflows/publish.yml:36 - npm audit --audit-level=critical is too weak to be a gate. Critical-only lets every high and moderate advisory in the Gatsby tree ship to the live site, which is the bulk of the exposure. Keeping the deploy green by lowering the threshold moves the untriaged risk onto the public site rather than out of the build. Change it to npm audit --omit=dev --audit-level=high at minimum, and target the default level or --audit-level=low; where a transitive advisory genuinely has no non-breaking fix, record it as a tracked exception (explicit override or a documented allowlist with an owner) instead of weakening the step for the whole tree.
.github/workflows/publish.yml (deleted) - the removed workflow was the only place npm run lint ran, both here and in the Gitea workflow that replaces it, so the prettier check is now not enforced anywhere in CI (nor is the existing typecheck script). Add the lint and typecheck steps to .gitea/workflows/publish.yml, or a separate workflow on pull_request, so formatting and type errors are still caught before a deploy.

2 findings above for review.

Reviewed the full diff at this head (.gitea/workflows/publish.yml, deleted .github/workflows/publish.yml, new .pre-commit-config.yaml, package.json, package-lock.json). The lockfile pruning is now consistent - no orphaned @cloudron / surfer / pickr / express-* entries remain - and the gitleaks hook is in place. - .gitea/workflows/publish.yml:36 - `npm audit --audit-level=critical` is too weak to be a gate. Critical-only lets every high and moderate advisory in the Gatsby tree ship to the live site, which is the bulk of the exposure. Keeping the deploy green by lowering the threshold moves the untriaged risk onto the public site rather than out of the build. Change it to `npm audit --omit=dev --audit-level=high` at minimum, and target the default level or `--audit-level=low`; where a transitive advisory genuinely has no non-breaking fix, record it as a tracked exception (explicit override or a documented allowlist with an owner) instead of weakening the step for the whole tree. - .github/workflows/publish.yml (deleted) - the removed workflow was the only place `npm run lint` ran, both here and in the Gitea workflow that replaces it, so the prettier check is now not enforced anywhere in CI (nor is the existing `typecheck` script). Add the lint and typecheck steps to .gitea/workflows/publish.yml, or a separate workflow on pull_request, so formatting and type errors are still caught before a deploy. 2 findings above for review.

allan merged commit bef1b99c78 into main

2026-10-28 12:16:33 +00:00

allan deleted branch chore/prune-stale-deploy-tooling

2026-10-28 12:16:33 +00:00

hermes referenced this pull request

2026-10-28 12:18:13 +00:00

chore(ci): gate deploys on new advisories, restore lint and typecheck #32

hermes commented

2026-10-28 12:18:17 +00:00