quickie

Author: NoResponseMate

.github/workflows/build.yaml

@@ -192,21 +192,43 @@ jobs:
                 name: Load fixtures in test application
                 run: (cd tests/Application && bin/console sylius:fixtures:load -n)
 
-            -   name: Run security checks
+            -   name: Run Security Checks
                 run: |
                     set -e
-                    composer audit --no-interaction
-                    
-                    symfony security:check --format=json > security.json || true
+
+                    composer audit --no-interaction --format=json > composer-audit.json || AUDIT_EXIT=$?
+
+                    if [ "${AUDIT_EXIT:-0}" -ne 0 ]; then
+                      IGNORED=$(jq -r '.config.audit.ignore[]?' composer.json | sort || true)
+                      FOUND=$(jq -r '.advisories[].advisories[].cve? // empty' composer-audit.json | sort | uniq)
+
+                      DIFF=$(comm -23 <(echo "$FOUND") <(echo "$IGNORED"))
+
+                      if [ -n "$DIFF" ]; then
+                        echo "❌ New vulnerabilities found by Composer audit:"
+                        echo "$DIFF"
+                        exit 1
+                      else
+                        echo "✅ Only ignored CVEs found in Composer audit."
+                      fi
+                    else
+                      echo "✅ No vulnerabilities found by Composer audit."
+                    fi
+
+                    symfony security:check --format=json > symfony-audit.json || true
+
                     jq --argjson ignore "$(jq '.config.audit.ignore' composer.json)" '
                       .vulnerabilities
                       | map(select(.cve | IN($ignore[]) | not))
                       | if length > 0 then
-                          (error("New vulnerabilities found: " + (map(.cve) | join(", "))))
+                          (error("❌ New vulnerabilities found by Symfony: " + (map(.cve) | join(", "))))
                         else
                           empty
                         end
-                    ' security.json
+                    ' symfony-audit.json
+
+                    echo
+                    echo "✅ All security checks passed (ignored CVEs excluded)."
 
             -
                 name: Run ECS