fix: clarify production dependency audit gates

[kang-heewon]

Fixes #1167.

Summary

• Moves pnpm overrides and auditConfig into pnpm-workspace.yaml, where pnpm 10 reads workspace security settings, and pins linkify-it to 5.0.2 so the production high-severity audit gate exits cleanly.
• Clarifies CI security reporting: pnpm audit:prod stays advisory-only in CI, while the Release workflow runs the same command as a blocking publish gate.
• Treats pnpm-workspace.yaml changes as release publish-gate candidates and adds workflow/config regression coverage for the advisory CI policy and blocking release policy.

Verification

• COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm config get auditConfig.ignoreGhsas --json - passed; pnpm reads GHSA-gv7w-rqvm-qjhr from workspace config.
• COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm audit:prod - passed; remaining production advisories are 3 low and 12 moderate.
• COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm exec vitest run scripts/tests/ci-workflow.spec.ts scripts/tests/release-workflow.spec.ts --config vitest.config.ts - passed, 21 tests.
• COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm check - passed.
• COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm test - passed, 225 successful tasks.
• COREPACK_ENABLE_DOWNLOAD_PROMPT=0 corepack pnpm typecheck - passed, 224 successful tasks.
• git diff --check - passed.

Self-review gates

• Correctness/regression: PASS - CI policy text, release blocking behavior, pnpm config location, and publish-candidate routing are covered by regression tests.
• Security/release policy: PASS - CI remains advisory for visibility, release publish gates remain blocking, and the high production advisory is resolved through an explicit override rather than a broad suppression.
• Maintainability/minimality: PASS - scoped to workflow policy, pnpm security config, generated dashboard wording, and tests; no publishable package behavior change or changeset required.

Review and QA

• Code review: addressed the only finding by asserting the Release audit step has no continue-on-error.
• Adversarial checks: verified pnpm reads the workspace GHSA ignore, audit:prod exits 0 at high severity, and pnpm-workspace.yaml changes trigger release publish gates.

[coderabbitai]

Warning

Review limit reached

@kang-heewon, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fb6c6d75-461a-4339-8724-e59b05b4a92d

📥 Commits

Reviewing files that changed from the base of the PR and between 555605e and e8e2cc3.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (8)

• .github/workflows/ci.yml
• .github/workflows/release.yml
• docs/release/package-quality-dashboard.md
• package.json
• pnpm-workspace.yaml
• scripts/package-quality-report.mts
• scripts/tests/ci-workflow.spec.ts
• scripts/tests/release-workflow.spec.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1167-ci-prod-audit-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark Results

✅ All benchmarks passed

Benchmark	p75	Threshold	Baseline	vs Baseline	Status	Notes
CrocoApp constructor	7.2μs	30.0ms	8.2μs	-11.8%	✅	-
CrocoApp lambdaHandler (10 controllers)	258.4μs	50.0ms	258.4μs	-0.0%	✅	-
Lambda cold-start simulation	414.4μs	80.0ms	418.1μs	-0.9%	✅	-
Lambda cold-start with headers	365.6μs	80.0ms	369.7μs	-1.1%	✅	-
Lambda cold-start with binary body	331.2μs	80.0ms	339.1μs	-2.3%	✅	-
Lambda cold-start with query params	296.5μs	80.0ms	301.3μs	-1.6%	✅	-
Lambda cold-start with authorizer context	296.5μs	80.0ms	299.8μs	-1.1%	✅	-
Lambda cold-start realistic scenario	297.4μs	80.0ms	299.2μs	-0.6%	✅	-
EventBusConfig.start (10 handlers)	1.4μs	10.0ms	1.4μs	-1.4%	✅	-
EventPublisher.publishNow single event	1.6μs	2.0ms	1.7μs	-2.4%	✅	-
DefaultHandlerResolver.resolve × 10	0.1μs	5.0ms	0.1μs	+0.0%	✅	-
Container.get singleton (cold)	69.9μs	5.0ms	70.3μs	-0.6%	✅	-
Container.register × 50 components	2.9ms	10.0ms	3.2ms	-10.3%	✅	-
Container.validate (50 components)	3.5ms	20.0ms	3.4ms	+2.1%	✅	-
Container.get singleton (warm)	1.6μs	500.0μs	1.6μs	-0.0%	✅	-
TelemetryRuntime.init (lambda preset)	1.9μs	200.0ms	1.1ms	-99.8%	✅	-
lambdaPreset config creation	1.4μs	2.0ms	1.4μs	+1.5%	✅	-

_{Updated: 2026-07-03T23:39:12.561Z · Commit: 613044b}