fail-fix

Author: NoResponseMate

.github/workflows/build.yaml

@@ -146,37 +146,34 @@ jobs:
             -   name: Run security checks
                 run: |
                     set -e
-                    
-                    composer audit --no-interaction --format=json > composer-audit.json || AUDIT_EXIT=$?
-                    
+
                     IGNORED=$(jq -r '.config.audit.ignore[]?' composer.json | sort || true)
-                    
-                    if [ "${AUDIT_EXIT:-0}" -ne 0 ]; then
-                      FOUND=$(jq -r '
-                        # Collect CVEs from both advisories and ignored-advisories
-                        (.advisories[]?.advisories[]?.cve? // empty),
-                        (.["ignored-advisories"][]?[]?.cve? // empty)
-                      ' composer-audit.json | sort | uniq)
-                    
-                      DIFF=$(comm -23 <(echo "$FOUND") <(echo "$IGNORED"))
-                    
-                      if [ -n "$DIFF" ]; then
-                        echo "❌ New vulnerabilities found by Composer audit:"
-                        echo "$DIFF"
-                        exit 1
-                      else
-                        echo "✅ No new vulnerabilities found by Composer audit."
-                      fi
+
+                    if [ -n "$IGNORED" ]; then
+                        echo "Ignored CVEs:"
+                        echo "$IGNORED"
+                        echo
+                    fi
+
+                    composer audit --no-interaction --format=json > composer-audit.json || true
+
+                    # Composer audit: check active advisories only
+                    FOUND=$(jq -r '(.advisories[]?.cve? // empty)' composer-audit.json | sort | uniq)
+                    DIFF=$(comm -23 <(echo "$FOUND") <(echo "$IGNORED"))
+
+                    if [ -n "$DIFF" ]; then
+                      echo "❌ New vulnerabilities found by Composer audit:"
+                      echo "$DIFF"
+                      exit 1
                     else
                       echo "✅ No new vulnerabilities found by Composer audit."
                     fi
-                    
+
                     symfony security:check --format=json > symfony-audit.json || true
-                    
+
                     FOUND=$(jq -r '.[]?.advisories[]?.cve? // empty' symfony-audit.json | sort | uniq)
-                    
                     DIFF=$(comm -23 <(echo "$FOUND") <(echo "$IGNORED"))
-                    
+
                     if [ -n "$DIFF" ]; then
                       echo "❌ New vulnerabilities found by Symfony security:check:"
                       echo "$DIFF"