[gpmayorga]

The pnpm-audit step in app-ci-checks.yml retried on any non-zero exit and, after three tries, printed:

::error::Audit failed after 3 attempts (possibly a transient registry error — see pnpm/pnpm#11265)

A real finding also exits non-zero. So when an advisory appears, the job runs the same audit three times, prints the same vulnerability table three times, and then blames the registry. That is what apps-invest#341 and apps-management#1298 showed on 2026-09-29 for GHSA-3wwx-pv8p-q78v (undici >=7.28.0 <7.29.1), and it reads like a flake to anyone scanning the last line.

What changes

The step now captures the audit output and decides from it:

Outcome	How it is recognised	Behaviour
Clean	exit 0	passes
Findings	the audit's summary line (N vulnerabilities found, or npm's N vulnerabilities ( / N moderate severity vulnerability)	fails on the first run: Dependency audit found vulnerabilities at or above the audit level (see the report above)
Registry or network error	ERR_PNPM_AUDIT_BAD_RESPONSE (the 410), ERR_PNPM_AUDIT_ENDPOINT_NOT_EXISTS, ERR_PNPM_META_FETCH_FAIL, ERR_PNPM_FETCH_429/5xx, ETIMEDOUT, ECONNRESET, ECONNREFUSED, EAI_AGAIN, ENOTFOUND, npm code E410/E429/E5xx	retried up to 3 times, 5s apart, then Audit registry request still failing after 3 attempts (see pnpm/pnpm#11265)
Anything else	none of the above	fails at once: Audit command failed (exit N) without a registry error; not retrying

Findings are checked first: a completed audit means the registry answered, so it is never retried. The step keeps its exit code instead of forcing 1. The full audit output is still printed on every attempt. audit-command and its default are unchanged, so no caller changes.

Verification

• actionlint (with shellcheck) and yamllint (relaxed, line-length disabled) clean.
• The step script run locally under sh -e against five simulated commands: clean (exit 0), findings (exit 1 at once, no retry), a 410 every time (3 attempts, registry message), a 410 that recovers on attempt 2 (passes), and an unrelated error (exit 2 at once, no retry).
• The real default audit-command (pnpm dlx pnpm@11.13.0 ... audit --audit-level moderate) run through the new step against apps-invest's current lockfile: 4 vulnerabilities found, reported as findings on the first attempt.
• No conflict with ci: authenticate GitHub Packages installs when the app opts in #16, which edits other steps of the same job.

It does not fix the advisory itself. The apps pin undici to 7.29.0 in pnpm.overrides; bumping that is for each app.

🤖 Generated with Claude Code

https://claude.ai/code/session_014vAMiNPVaNSZvobuesTQnA

---

Generated by Claude Code