[PresentJay]

mountebank already has CodeQL and a CircleCI application pipeline. I contribute to zero-shelter and proposed this as an experiment with a manual advisory snapshot of the committed npm tree, without starting the test-double server.

Only .github/workflows/dependency-report.yml changes. The workflow_dispatch job uses contents: read, SHA-pinned official actions and pinned zero-shelter@0.0.10. It reads npm audit --package-lock-only --ignore-scripts output and retains generated HTML for 7 days. Findings exit 1; scanner/judgement errors exit 2; both fail the job. The job installs no project dependencies, runs no project lifecycle scripts, accepts no baseline and changes no CircleCI or release setting.

The saved local validation at 80a3525c531f produced 35 raw / 29 merged / 29 outstanding findings, 0 accepted. npm audit and JSON/HTML exited 1. This reduction occurred within one npm audit input; it is not evidence of cross-scanner reconciliation. YAML, Bash and whitespace checks passed; manifest and lockfile stayed unchanged. These are earlier results, not a new scan. The application/OS test matrix and new hosted manual workflow were not run locally.

The report does not establish reachability. npm audit sends dependency metadata to the configured registry, and npx downloads and executes the third-party CLI in CI. I used AI assistance to prepare this proposal and description.

Would this report add a useful review step alongside CircleCI? I'm happy to withdraw it if it duplicates the existing process.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[PresentJay]

I contribute to zero-shelter and proposed this as an optional snapshot of the committed npm advisories, alongside mountebank's CircleCI and CodeQL checks. Would a manually requested HTML artifact fit your dependency review process? If the current tooling already gives you this view, I am happy to withdraw the proposal.