ci(audit): fail on an accepted advisory that is no longer reported

`bun audit --ignore <id>` accepts ids it never saw without complaining, so an
inline ignore list keeps suppressing an advisory long after the dependency was
patched and nothing reports that the entry is dead. Three of the five ignored
advisories were in that state: `form-data`, `path-to-regexp`, and `undici` each
had a patched release inside the range their parents already declare, so
re-resolving those three lock entries clears them and the ignores go away.

Accepted advisories now live in `.github/audit-allowlist.json`, one entry per
directory with a written reason, and the wrapper fails both on an advisory that
is not accepted and on an acceptance that no longer matches anything. The
threshold is per directory because `vendor` is bundled and shipped, so a moderate
advisory there reaches customers, while `--audit-level=high` had been filtering
it out.

Author: BridgeAR

.github/audit-allowlist.json

@@ -0,0 +1,48 @@
+{
+  "$comment": [
+    "Advisories that `node scripts/audit.js` is allowed to see without failing, per install directory.",
+    "Every entry needs a reason naming why the advisory cannot simply be fixed by resolving a patched version.",
+    "The script fails when an entry here is no longer reported, so a fixed advisory cannot silently rot in this file.",
+    "`level` is the lowest severity that fails for that directory. Directories whose contents ship to customers are",
+    "audited below `high`, because a moderate advisory in shipped code still reaches users."
+  ],
+  "directories": {
+    ".": {
+      "level": "high",
+      "allow": [
+        {
+          "id": "GHSA-5c6j-r48x-rmvq",
+          "package": "serialize-javascript",
+          "reason": "Patched in 7.0.3, but mocha declares `serialize-javascript@^6.0.2` and cannot resolve a 7.x. Dev-only test runner; the RCE needs an attacker-controlled object to serialize, which only mocha's own parallel-mode test metadata reaches. Drops out when mocha widens the range."
+        },
+        {
+          "id": "GHSA-mh99-v99m-4gvg",
+          "package": "brace-expansion",
+          "reason": "The advisory declares `<= 5.0.7` across every major, so the 1.x and 2.x copies that mocha, glob and @eslint/eslintrc pin can never clear it. The root copy is already on a patched 5.x. Dev-only, and the DoS needs a hostile glob pattern, which only this repository's own scripts supply."
+        }
+      ]
+    },
+    "vendor": {
+      "level": "moderate",
+      "allow": [
+        {
+          "id": "GHSA-8988-4f7v-96qf",
+          "package": "@opentelemetry/core",
+          "reason": "Patched in 2.8.0, which is outside the `>=1.14.0 <1.31.0` range vendor/package.json pins for OpenTelemetry compatibility, and `@opentelemetry/resources@1.30.1` pins core to an exact 1.30.1. Clearing it needs a deliberate OpenTelemetry major upgrade of the vendored tree, not a lockfile bump. This code is bundled and shipped, so it is audited at moderate rather than filtered out by a high-only threshold."
+        }
+      ]
+    },
+    "docs": {
+      "level": "high",
+      "allow": []
+    },
+    ".github/all-green": {
+      "level": "high",
+      "allow": []
+    },
+    ".github/actions/datadog-ci": {
+      "level": "high",
+      "allow": []
+    }
+  }
+}

.github/workflows/audit.yml

@@ -34,15 +34,10 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ./.github/actions/node/latest
-      # Root dev tooling reaches these through @actions/*, Axios, Mocha, and Express.
-      # Keep them explicit so any newly introduced high or critical advisory still fails.
-      # GHSA-mh99-v99m-4gvg declares `<= 5.0.7` across every brace-expansion major, so the 1.x
-      # and 2.x copies Mocha, glob, and @eslint/eslintrc pin can never clear it; 5.x is patched.
-      - run: |
-          bun audit --audit-level=high \
-            --ignore GHSA-vxpw-j846-p89q \
-            --ignore GHSA-hmw2-7cc7-3qxx \
-            --ignore GHSA-5c6j-r48x-rmvq \
-            --ignore GHSA-j3q9-mxjg-w52f \
-            --ignore GHSA-mh99-v99m-4gvg
-        working-directory: ${{ matrix.directory }}
+      # Severity threshold and accepted advisories both live in .github/audit-allowlist.json, per directory, each with
+      # a written reason. The wrapper also fails once an accepted advisory stops being reported, which a bare
+      # `--ignore` list cannot do: `bun audit` takes unknown ids without complaint, so a suppression silently outlives
+      # the advisory it was added for.
+      - run: node scripts/audit.js "$DIRECTORY"
+        env:
+          DIRECTORY: ${{ matrix.directory }}

bun.lock

@@ -0,0 +1,143 @@
+'use strict'
+
+/* eslint-disable no-console */
+
+// Wraps `bun audit` so an accepted advisory has to carry a written reason, and so an acceptance that is no longer
+// needed fails instead of lingering. `bun audit --ignore <id>` accepts ids it never saw without complaining, so an
+// inline ignore list keeps suppressing an advisory long after the dependency was patched and nothing ever reports that
+// the entry is dead. Severity is resolved per directory because a moderate advisory in `vendor` is bundled and reaches
+// customers, while the same severity in the dev-only trees does not.
+//
+//   node scripts/audit.js [--allowlist <path>] [<directory> ...]
+//
+// Directories resolve against the working directory and default to every directory the allowlist names.
+
+const { spawnSync } = require('node:child_process')
+const { readFileSync } = require('node:fs')
+const path = require('node:path')
+
+const { getBunBinary } = require('./bun')
+
+const SEVERITIES = ['info', 'low', 'moderate', 'high', 'critical']
+const DEFAULT_ALLOWLIST = path.join(__dirname, '..', '.github', 'audit-allowlist.json')
+
+/**
+ * @param {string[]} argv
+ * @returns {{ allowlistPath: string, directories: string[] }}
+ */
+function parseArguments (argv) {
+  let allowlistPath = DEFAULT_ALLOWLIST
+  const directories = []
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === '--allowlist') {
+      allowlistPath = path.resolve(argv[++i])
+    } else {
+      directories.push(argv[i])
+    }
+  }
+  return { allowlistPath, directories }
+}
+
+/**
+ * @param {string} url
+ * @returns {string} The GHSA identifier the advisory URL ends with.
+ */
+function ghsaId (url) {
+  return String(url).split('/').pop()
+}
+
+/**
+ * @param {string} directory
+ * @returns {Map<string, { id: string, package: string, severity: string, title: string }>}
+ */
+function runAudit (directory) {
+  const result = spawnSync(getBunBinary(), ['audit', '--json'], {
+    cwd: path.resolve(directory),
+    encoding: 'utf8',
+    // `bun audit` exits non-zero whenever it finds anything, so the status alone cannot tell "advisories present" from
+    // "the command failed"; parsing the report is what decides.
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+
+  if (!result.stdout?.trim()) {
+    // A clean tree still prints an empty object, so missing output means bun itself failed.
+    throw new Error(`\`bun audit\` produced no output in '${directory}':\n${result.stderr ?? ''}`)
+  }
+
+  let report
+  try {
+    report = JSON.parse(result.stdout)
+  } catch {
+    throw new Error(`Could not parse \`bun audit --json\` output in '${directory}':\n${result.stdout}`)
+  }
+
+  const advisories = new Map()
+  for (const [packageName, entries] of Object.entries(report)) {
+    for (const advisory of [entries].flat()) {
+      // Without a URL there is no GHSA id to match an acceptance against, and a synthesized one would silently never
+      // match, so surface it instead.
+      if (!advisory?.url) throw new Error(`Advisory for ${packageName} in '${directory}' has no URL to identify it.`)
+      const id = ghsaId(advisory.url)
+      advisories.set(id, { id, package: packageName, severity: advisory.severity, title: advisory.title })
+    }
+  }
+  return advisories
+}
+
+/**
+ * @param {string} directory
+ * @param {{ level: string, allow: Array<{ id: string, package: string, reason: string }> }} config
+ * @param {string} allowlistLabel
+ * @returns {string[]} One description per failure, empty when the directory is clean.
+ */
+function auditDirectory (directory, config, allowlistLabel) {
+  const threshold = SEVERITIES.indexOf(config.level)
+  if (threshold === -1) throw new Error(`Unknown level '${config.level}' for '${directory}'`)
+
+  const allowed = new Map()
+  for (const entry of config.allow) {
+    if (!entry.reason?.trim()) throw new Error(`Allowlist entry ${entry.id} for '${directory}' needs a reason.`)
+    allowed.set(entry.id, entry)
+  }
+
+  const advisories = runAudit(directory)
+  const problems = []
+
+  for (const advisory of advisories.values()) {
+    if (allowed.has(advisory.id) || SEVERITIES.indexOf(advisory.severity) < threshold) continue
+    problems.push(
+      `${directory}: unaccepted ${advisory.severity} advisory ${advisory.id} in ${advisory.package} ` +
+      `(${advisory.title}). Resolve a patched version, or add it to ${allowlistLabel} with a reason why it cannot ` +
+      'be resolved.'
+    )
+  }
+
+  for (const entry of allowed.values()) {
+    if (advisories.has(entry.id)) continue
+    problems.push(
+      `${directory}: accepted advisory ${entry.id} (${entry.package}) is no longer reported. ` +
+      `Remove it from ${allowlistLabel}.`
+    )
+  }
+
+  return problems
+}
+
+const { allowlistPath, directories: requested } = parseArguments(process.argv.slice(2))
+const allowlistLabel = path.relative(process.cwd(), allowlistPath) || allowlistPath
+const { directories } = JSON.parse(readFileSync(allowlistPath, 'utf8'))
+const selected = requested.length > 0 ? requested : Object.keys(directories)
+const problems = []
+
+for (const directory of selected) {
+  const config = directories[directory]
+  if (!config) throw new Error(`'${directory}' has no entry in ${allowlistLabel}.`)
+  problems.push(...auditDirectory(directory, config, allowlistLabel))
+}
+
+if (problems.length > 0) {
+  for (const problem of problems) console.error(problem)
+  process.exit(1)
+}
+
+console.log(`No unaccepted advisories in: ${selected.join(', ')}`)

scripts/audit.js

@@ -0,0 +1,134 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { spawnSync } = require('node:child_process')
+const fs = require('node:fs')
+const { tmpdir } = require('node:os')
+const path = require('node:path')
+
+const repoRoot = path.join(__dirname, '..', '..')
+const auditScript = path.join(repoRoot, 'scripts', 'audit.js')
+const bunVersion = require('../../package.json').devDependencies.bun
+
+/**
+ * @param {string} id
+ * @param {string} severity
+ */
+function advisory (id, severity) {
+  return { id: 1, url: `https://github.com/advisories/${id}`, severity, title: `${id} title` }
+}
+
+describe('scripts/audit.js', () => {
+  let fixtureDirectory
+
+  beforeEach(() => {
+    fixtureDirectory = fs.mkdtempSync(path.join(tmpdir(), 'dd-trace-audit-'))
+  })
+
+  afterEach(() => {
+    fs.rmSync(fixtureDirectory, { recursive: true, force: true })
+  })
+
+  it('passes when every advisory at or above the threshold is accepted', () => {
+    const result = runAudit({
+      report: {
+        'some-package': [advisory('GHSA-aaaa-aaaa-aaaa', 'high')],
+        'noisy-package': [advisory('GHSA-cccc-cccc-cccc', 'low')],
+      },
+      allow: [{ id: 'GHSA-aaaa-aaaa-aaaa', package: 'some-package', reason: 'upstream ships no patched release' }],
+    })
+
+    assert.strictEqual(result.status, 0, result.stderr)
+  })
+
+  it('fails on an advisory at the threshold that is not accepted', () => {
+    const result = runAudit({
+      report: { 'some-package': [advisory('GHSA-bbbb-bbbb-bbbb', 'high')] },
+      allow: [],
+    })
+
+    assert.strictEqual(result.status, 1)
+    assert.match(result.stderr, /unaccepted high advisory GHSA-bbbb-bbbb-bbbb in some-package/)
+  })
+
+  it('ignores an advisory below the directory threshold', () => {
+    const result = runAudit({
+      report: { 'some-package': [advisory('GHSA-cccc-cccc-cccc', 'moderate')] },
+      allow: [],
+    })
+
+    assert.strictEqual(result.status, 0, result.stderr)
+  })
+
+  it('fails on an accepted advisory that is no longer reported', () => {
+    // The reason this wrapper exists: `bun audit --ignore <id>` takes ids it never saw without complaining, so a
+    // suppression keeps hiding an advisory long after the dependency was patched and nothing reports the entry is dead.
+    const result = runAudit({
+      report: {},
+      allow: [{ id: 'GHSA-dddd-dddd-dddd', package: 'gone', reason: 'was unpatched when this was added' }],
+    })
+
+    assert.strictEqual(result.status, 1)
+    assert.match(result.stderr, /GHSA-dddd-dddd-dddd \(gone\) is no longer reported/)
+  })
+
+  it('fails when an accepted advisory carries no reason', () => {
+    const result = runAudit({
+      report: { 'some-package': [advisory('GHSA-eeee-eeee-eeee', 'high')] },
+      allow: [{ id: 'GHSA-eeee-eeee-eeee', package: 'some-package', reason: '  ' }],
+    })
+
+    assert.strictEqual(result.status, 1)
+    assert.match(result.stderr, /needs a reason/)
+  })
+
+  it('fails when an audited directory has no allowlist entry', () => {
+    const result = runAudit({ report: {}, allow: [], directory: 'unlisted' })
+
+    assert.strictEqual(result.status, 1)
+    assert.match(result.stderr, /has no entry in/)
+  })
+
+  it('fails when bun produces no output rather than reporting a clean tree', () => {
+    const result = runAudit({ report: {}, allow: [], bunOutput: '' })
+
+    assert.strictEqual(result.status, 1)
+    assert.match(result.stderr, /produced no output/)
+  })
+
+  /**
+   * Runs the real script against a stub `bun` so the assertions cover the wrapper's decisions rather than whatever the
+   * repository's own lockfiles happen to report today.
+   *
+   * @param {{ report: object, allow: object[], directory?: string, bunOutput?: string }} options
+   * @returns {import('node:child_process').SpawnSyncReturns<string>}
+   */
+  function runAudit ({ report, allow, directory = 'audited', bunOutput }) {
+    const allowlistPath = path.join(fixtureDirectory, 'audit-allowlist.json')
+    fs.writeFileSync(allowlistPath, JSON.stringify({ directories: { audited: { level: 'high', allow } } }))
+    fs.mkdirSync(path.join(fixtureDirectory, 'audited'), { recursive: true })
+
+    // `getBunBinary()` accepts the `bun` on PATH only when it reports the pinned version, so the stub answers
+    // `--version` as well as `audit --json`.
+    const stubDirectory = path.join(fixtureDirectory, 'bin')
+    fs.mkdirSync(stubDirectory, { recursive: true })
+    const stub = path.join(stubDirectory, 'bun')
+    fs.writeFileSync(stub, [
+      '#!/bin/sh',
+      'if [ "$1" = "--version" ]; then',
+      `  echo ${bunVersion}`,
+      '  exit 0',
+      'fi',
+      "cat <<'REPORT'",
+      bunOutput ?? JSON.stringify(report),
+      'REPORT',
+    ].join('\n'))
+    fs.chmodSync(stub, 0o755)
+
+    return spawnSync(process.execPath, [auditScript, '--allowlist', allowlistPath, directory], {
+      cwd: fixtureDirectory,
+      encoding: 'utf8',
+      env: { ...process.env, PATH: `${stubDirectory}:${process.env.PATH}` },
+    })
+  }
+})