fix(security): gate landing dependency audit

.github/workflows/build.yml

@@ -40,6 +40,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm audit:deps
       - run: pnpm typecheck
       - run: pnpm lint
 

.github/workflows/remote-boss-platforms.yml

@@ -40,6 +40,7 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm audit:deps
       - name: Build Boss edition
         run: node boss-build/build-boss-edition.mjs --platform=win --version=${{ inputs.version }}
         shell: bash

package.json

@@ -25,6 +25,7 @@
     "release:website": "node scripts/release-website.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "audit:deps": "pnpm audit && npm --prefix landing audit --omit=dev",
     "test": "node --disable-warning=ExperimentalWarning ./node_modules/vitest/vitest.mjs run",
     "typecheck": "tsc --noEmit",
     "test:unit": "node --disable-warning=ExperimentalWarning ./node_modules/vitest/vitest.mjs run --config vitest.config.ts tests/unit",
@@ -34,7 +35,7 @@
     "test:e2e": "node --no-warnings ./node_modules/@playwright/test/cli.js test -c tests/e2e/playwright.config.ts",
     "test:run": "pnpm test:unit && pnpm test:integration && pnpm test:eval && pnpm test:e2e",
     "verify": "pnpm typecheck && pnpm lint && pnpm test:unit && pnpm test:integration && pnpm test:eval && pnpm test:e2e",
-    "verify:release": "pnpm verify && pnpm build:dir",
+    "verify:release": "pnpm audit:deps && pnpm verify && pnpm build:dir",
     "postinstall": "node scripts/postinstall.mjs"
   },
   "dependencies": {

scripts/release-boss.mjs

@@ -181,6 +181,7 @@ async function main() {
 
   const repo = await getRepoInfo();
   await ensureRemoteBuildPrerequisites(repo);
+  await run("pnpm", ["audit:deps"]);
 
   const currentVersion = (await readPackageJson()).version;
   const nextVersion = options.version ?? currentVersion;

scripts/release-local-mac.mjs

@@ -138,6 +138,7 @@ async function main() {
   process.env.AGENTCOMPANY_ELECTRON_PUBLISH = "never";
 
   validatePreflight();
+  await run("pnpm", ["audit:deps"]);
 
   const currentVersion = (await readPackageJson()).version;
   const nextVersion = options.version ?? (options.bump ? bumpPatchVersion(currentVersion) : currentVersion);

scripts/release-local-winlinux.mjs

@@ -140,6 +140,7 @@ async function main() {
   if (nextVersion !== pkgVersion) {
     console.log(`[release-local-winlinux] version override: ${pkgVersion} -> ${nextVersion}`);
   }
+  await run("pnpm", ["audit:deps"]);
 
   await rm(localReleaseDir, { recursive: true, force: true });
   await rm(buildReleaseDir, { recursive: true, force: true });

scripts/release-local.mjs

@@ -51,7 +51,7 @@ function printHelp() {
 
 Options:
   --platforms=mac,win,linux   Comma-separated platform list (default: all)
-  --skip-verify               Skip pnpm verify before release builds
+  --skip-verify               Skip dependency audit and pnpm verify before release builds
   --no-upload                 Build artifacts locally without publishing
   --help                      Show this help
 
@@ -251,6 +251,7 @@ async function main() {
 
   await rm(localReleaseDir, { recursive: true, force: true });
   if (!options.skipVerify) {
+    await run("pnpm", ["audit:deps"]);
     await run("pnpm", ["verify"]);
   }
   if (options.platforms.includes("mac")) {

scripts/release-public-cloudflare.mjs

@@ -95,7 +95,7 @@ function printHelp() {
 
 Options:
   --version=x.y.z          Explicit version. Defaults to current patch + 1.
-  --skip-verify            Skip local pnpm verify before packaging.
+  --skip-verify            Skip local dependency audit and pnpm verify before packaging.
   --delete-remote-branch   Delete the GitHub snapshot branch after success.
   --keep-transport-release Keep the temporary draft GitHub release after success.
   --help                   Show this help.
@@ -280,6 +280,7 @@ async function main() {
   await resetReleaseStaging();
 
   if (!options.skipVerify) {
+    await run("pnpm", ["audit:deps"]);
     await run("pnpm", ["verify"]);
   }
 

scripts/release-website.mjs

@@ -103,6 +103,7 @@ async function main() {
   await loadEnvFile(join(rootDir, ".env.release"));
 
   await prepareR2ReleaseHost({ rootDir });
+  await runPlain("pnpm", ["audit:deps"]);
 
   const version = (await readPackageJson()).version;
   console.log(`[release-website] regenerating landing for version ${version}`);

scripts/resume-release-public.mjs

@@ -83,6 +83,7 @@ async function main() {
   await loadEnvFile(join(rootDir, ".env.release"));
 
   const repo = await getRepoInfo();
+  await run("pnpm", ["audit:deps"]);
 
   await uploadWinAndLinuxToR2();
   await run("node", ["scripts/generate-landing-release-links.mjs"]);