fix: clear dependency security advisories

2026-07-10 18:59:03 +08:00
parent d730e51c3d
commit e049cb6880
11 changed files with 242 additions and 41 deletions
@@ -21,6 +21,11 @@ run the same command again. No systemd unit is installed until configuration,
 paths, Node, bubblewrap, `socat`, `cph --version`, PostgreSQL connectivity and directory
 ownership all pass preflight.

+The deployment path also runs `npm run audit:production` from the locked clean
+install before building or restarting the service. A current high or critical
+production advisory therefore blocks deployment instead of becoming a warning
+buried in CI output.
+
 An existing service account is accepted only when its primary group, home and
 non-login shell match the requested configuration and it has no supplementary
 groups. After provisioning, the installer executes path-access, built Hub,