[PresentJay]

A report here would cover bplist-parser's locked development/build tree; the package has no regular runtime dependencies. I contribute to zero-shelter and am testing whether its manual HTML presentation is useful in that setting.

This adds only .github/workflows/dependency-report.yml. The workflow_dispatch job requests contents: read, uses SHA-pinned official actions, and passes npm audit --package-lock-only --ignore-scripts output to pinned zero-shelter@0.0.10. Generated HTML is retained for 7 days. Findings exit 1; scanner/judgement failures exit 2, and neither is treated as a pass. No project dependencies are installed or upgraded, no baseline is accepted, and existing validation/publishing workflows are unchanged.

The saved 2 November 2026 capture at 2d99e7e6a1ee contained 13 raw / 13 merged / 13 outstanding findings, 0 accepted. npm audit and JSON/HTML exited 1; the synthetic scanner-error control exited 2. YAML, both Bash blocks and whitespace checks passed; manifest/lockfile hashes stayed unchanged. These are earlier results. Application test/build checks and the new hosted manual workflow were not run.

The report uses npm audit alone, with no reachability finding. npm audit queries the configured registry with dependency metadata; npx downloads and executes the third-party CLI in CI. I used AI assistance for this proposal and description.

Would this report be useful when reviewing the development toolchain? I'm happy to withdraw it if the existing checks are sufficient.

[PresentJay]

I contribute to zero-shelter and proposed this for bplist-parser’s locked development and build dependencies, since it has no regular runtime dependencies. Would a manually generated HTML report help you review the npm advisory data, or would the extra workflow add little to your current process?

[joeferner]

Thanks for the PR, and for being upfront about your involvement with zero-shelter.

I'm going to pass on this one. bplist-parser has no runtime dependencies, so the findings are all in the dev/build toolchain, and the report would show the same data as npm audit. I'd rather not add a third-party CLI that runs via npx in CI just to change how that data is presented.

How does zero-shelter differ from just using Dependabot or Trivy?

Closing this for now. Thanks again for taking the time.

[PresentJay]

Thanks for asking; I understand the decision. Dependabot provides vulnerability alerts and update PRs. Trivy covers dependency vulnerabilities, secrets and misconfigurations, with reporting and ignore policies too. zero-shelter 0.0.10 focuses on reconciling supported dependency reports, explaining its scoring, and tracking explicitly accepted findings locally. In this PR, though, it used only npm audit, without a baseline or added detection coverage: the difference was just the scored HTML presentation. I respect keeping this PR closed.