From 99ae7efa55e599bb77aea52a9195be9df471033e Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Thu, 8 Oct 2026 09:23:24 +0300
Subject: [PATCH 1/6] refactor: Add security scan for multiple scopes in CI
 workflow

---
 .github/workflows/security-audit.yml | 49 ++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index 5ea17b63696..b54ebdf31f5 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -36,3 +36,52 @@ jobs:
 
       - name: Use audit-ci
         run: npm run audit
+
+  security-scan-latest:
+    name: "Security Audit · latest (${{ matrix.scope }}) · ${{ matrix.branch }}"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false # Continue all jobs even if one fails
+      matrix:
+        branch: ["main", "v4"] # List of branches to run the security audit on
+        scope: ["dev + prod", "prod only"]
+        include:
+          # "dev + prod": everything the repository pulls in, resolved to latest
+          - scope: "dev + prod"
+            audit_flags: ""
+          # "prod only": exactly what consumers install, resolved to latest
+          - scope: "prod only"
+            audit_flags: "-- --skip-dev"
+
+    steps:
+      - name: Checkout '${{ matrix.branch }}' branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ matrix.branch }}
+
+      # Use Node.js 24 to get npm 11 instead of npm 10. The default runner Node.js version is 22, which
+      # comes with npm 10. This could lead to different installation paths that could conflict with the
+      # allowlist in audit-ci.jsonc.
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+
+      # Drop the lockfile so npm re-resolves every range to the latest satisfying version.
+      # Unlike the pinned "npm ci" audit above, this reflects what actually lands in a fresh
+      # installation today (we publish without a lockfile), so we can react to new advisories
+      # before Dependabot bumps the committed package-lock.json.
+      #
+      # We install the full tree (including devDependencies) on purpose: audit-ci is itself a
+      # devDependency, so "--omit=dev" would remove the audit tool. The audit scope is instead
+      # controlled by the "--skip-dev" flag below, which filters the dependency graph npm audit
+      # reads from the lockfile — it does not require devDependencies to be absent from disk.
+      - name: Resolve latest dependencies (ignore lockfile)
+        run: |
+          rm -rf node_modules package-lock.json
+          npm install --no-audit --no-fund
+
+      # For the "prod only" scope, "--skip-dev" makes audit-ci pass "--omit=dev" to npm audit so
+      # only the production dependencies consumers receive are audited.
+      - name: Use audit-ci
+        run: npm run audit ${{ matrix.audit_flags }}

From 384c43884313b64a2e6312b3148efdff8587d701 Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Thu, 8 Oct 2026 09:42:04 +0300
Subject: [PATCH 2/6] fix: CodeQL's security recommendations

---
 .github/workflows/security-audit.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index b54ebdf31f5..dca3db65c07 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -22,6 +22,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.branch }}
+          # This workflow runs in the privileged default-branch context (schedule / dispatch) but
+          # checks out other branches. Do not persist the GITHUB_TOKEN in the git config so the
+          # checked-out code cannot inherit push/API credentials (CodeQL cache-poisoning).
+          persist-credentials: false
 
       # Use Node.js 24 to get npm 11 instead of npm 10. The default runner Node.js version is 22, which
       # comes with npm 10. This could lead to different installation paths that could conflict with the
@@ -31,8 +35,11 @@ jobs:
         with:
           node-version: "24"
 
+      # --ignore-scripts: never run dependency lifecycle scripts here. The audit only needs the
+      # resolved tree, and this removes execution of untrusted code in the privileged
+      # default-branch context (CodeQL cache-poisoning).
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Use audit-ci
         run: npm run audit
@@ -58,6 +65,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ matrix.branch }}
+          # This workflow runs in the privileged default-branch context (schedule / dispatch) but
+          # checks out other branches. Do not persist the GITHUB_TOKEN in the git config so the
+          # checked-out code cannot inherit push/API credentials (CodeQL cache-poisoning).
+          persist-credentials: false
 
       # Use Node.js 24 to get npm 11 instead of npm 10. The default runner Node.js version is 22, which
       # comes with npm 10. This could lead to different installation paths that could conflict with the
@@ -76,10 +87,14 @@ jobs:
       # devDependency, so "--omit=dev" would remove the audit tool. The audit scope is instead
       # controlled by the "--skip-dev" flag below, which filters the dependency graph npm audit
       # reads from the lockfile — it does not require devDependencies to be absent from disk.
+      #
+      # --ignore-scripts: never run dependency lifecycle scripts here. The audit only needs the
+      # resolved tree, and this removes execution of untrusted code in the privileged
+      # default-branch context (CodeQL cache-poisoning).
       - name: Resolve latest dependencies (ignore lockfile)
         run: |
           rm -rf node_modules package-lock.json
-          npm install --no-audit --no-fund
+          npm install --no-audit --no-fund --ignore-scripts
 
       # For the "prod only" scope, "--skip-dev" makes audit-ci pass "--omit=dev" to npm audit so
       # only the production dependencies consumers receive are audited.

From 3d0bb2dfdb1d68c80aac05aa988076271f416f2b Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Thu, 8 Oct 2026 10:32:34 +0300
Subject: [PATCH 3/6] refactor: Extract audit into an external action

---
 .github/actions/dependency-audit/action.yml |  32 ++++++
 .github/actions/dependency-audit/audit.sh   |  54 +++++++++++
 .github/workflows/security-audit-main.yml   |  27 ++++++
 .github/workflows/security-audit-v4.yml     |  32 ++++++
 .github/workflows/security-audit.yml        | 102 --------------------
 5 files changed, 145 insertions(+), 102 deletions(-)
 create mode 100644 .github/actions/dependency-audit/action.yml
 create mode 100644 .github/actions/dependency-audit/audit.sh
 create mode 100644 .github/workflows/security-audit-main.yml
 create mode 100644 .github/workflows/security-audit-v4.yml
 delete mode 100644 .github/workflows/security-audit.yml

diff --git a/.github/actions/dependency-audit/action.yml b/.github/actions/dependency-audit/action.yml
new file mode 100644
index 00000000000..388b9b801e8
--- /dev/null
+++ b/.github/actions/dependency-audit/action.yml
@@ -0,0 +1,32 @@
+name: "Dependency security audit"
+description: >
+  Audits the already-checked-out project's dependencies in three scopes — locked (npm ci),
+  latest (dev + prod), and latest (production only) — so a repository can see what its committed
+  lockfile pins versus what a fresh install resolves to today. Operates on the current workspace;
+  the caller is responsible for the checkout.
+
+inputs:
+  node-version:
+    description: "Node.js version to set up (npm 11+ recommended for stable audit paths)."
+    default: "24"
+  audit-command:
+    description: "Command that runs the audit and exits non-zero on findings."
+    default: "npm run audit"
+  prod-only-args:
+    description: "Extra arguments appended to audit-command for the production-only scope."
+    default: "-- --skip-dev"
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Run dependency audit (all scopes)
+      shell: bash
+      env:
+        AUDIT_COMMAND: ${{ inputs.audit-command }}
+        PROD_ONLY_ARGS: ${{ inputs.prod-only-args }}
+      run: bash "${{ github.action_path }}/audit.sh"
diff --git a/.github/actions/dependency-audit/audit.sh b/.github/actions/dependency-audit/audit.sh
new file mode 100644
index 00000000000..e3496ae7345
--- /dev/null
+++ b/.github/actions/dependency-audit/audit.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# Audits the current workspace's dependencies in three scopes and reports each one.
+# All scopes always run; the script exits non-zero if any scope reported advisories.
+#
+#   locked · ci (dev + prod)   What the committed package-lock.json pins — the reproducible
+#                              tree we build and test against.
+#   latest (dev + prod)        What the whole repo resolves to today when the lockfile is
+#                              ignored — early warning across everything we pull in.
+#   latest (prod only)         What a fresh install gives consumers today (we publish without
+#                              a lockfile) — the scope that reaches end users.
+#
+# npm resolves "latest" by re-installing after the lockfile is removed. "--ignore-scripts" is
+# used everywhere: the audit only needs the resolved dependency tree, and never executing
+# dependency lifecycle code keeps this safe to run on untrusted/unpinned versions.
+
+# Note: no "-e" — a failing scope must not stop the remaining scopes from running.
+set -uo pipefail
+
+AUDIT_COMMAND="${AUDIT_COMMAND:-npm run audit}"
+PROD_ONLY_ARGS="${PROD_ONLY_ARGS:- -- --skip-dev}"
+
+failed=0
+
+# run_scope <label> <command...>
+run_scope() {
+	local label="$1"
+	shift
+	echo "::group::Audit — ${label}"
+	if "$@"; then
+		echo "✓ ${label}: no blocking advisories"
+	else
+		echo "✗ ${label}: advisories found"
+		failed=1
+	fi
+	echo "::endgroup::"
+}
+
+# 1) Locked tree, as committed.
+npm ci --ignore-scripts
+# shellcheck disable=SC2086 # intentional word-splitting of the configured command
+run_scope "locked · ci (dev + prod)" ${AUDIT_COMMAND}
+
+# Re-resolve every range to its latest satisfying version.
+rm -rf node_modules package-lock.json
+npm install --no-audit --no-fund --ignore-scripts
+
+# 2) Latest, full tree. 3) Latest, production only (same install, narrower audit scope).
+# shellcheck disable=SC2086
+run_scope "latest (dev + prod)" ${AUDIT_COMMAND}
+# shellcheck disable=SC2086
+run_scope "latest (prod only)" ${AUDIT_COMMAND} ${PROD_ONLY_ARGS}
+
+exit "${failed}"
diff --git a/.github/workflows/security-audit-main.yml b/.github/workflows/security-audit-main.yml
new file mode 100644
index 00000000000..9e1dc1eb85f
--- /dev/null
+++ b/.github/workflows/security-audit-main.yml
@@ -0,0 +1,27 @@
+name: Security Audit (main)
+
+on:
+  schedule:
+    - cron: "36 4 * * *" # Run once a day
+  workflow_dispatch:
+
+# No permissions are required for this workflow
+permissions: {}
+
+jobs:
+  security-scan:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      # Plain checkout of this workflow's own ref (the default branch). No "ref:" to another
+      # branch, so no untrusted code runs in the privileged default-branch context — this keeps
+      # the workflow clear of the CodeQL "cache poisoning" finding. v4 is audited by its own
+      # workflow (security-audit-v4.yml).
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Reusable engine: audits locked (npm ci) + latest (dev + prod) + latest (prod only).
+      - name: Audit dependencies
+        uses: ./.github/actions/dependency-audit
diff --git a/.github/workflows/security-audit-v4.yml b/.github/workflows/security-audit-v4.yml
new file mode 100644
index 00000000000..8321d831a92
--- /dev/null
+++ b/.github/workflows/security-audit-v4.yml
@@ -0,0 +1,32 @@
+name: Security Audit (v4)
+
+on:
+  schedule:
+    - cron: "46 4 * * *" # Run once a day (offset from the main audit)
+  workflow_dispatch:
+
+# No permissions are required for this workflow
+permissions: {}
+
+jobs:
+  security-scan:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      # Scheduled workflows always run from the default branch, so auditing v4 requires an
+      # explicit checkout of the v4 branch. CodeQL flags this as a potential cache-poisoning
+      # source (untrusted code checked out in the default-branch context); it is accepted/dismissed
+      # here because "ref" is a fixed, trusted branch of this repository, the audit runs with
+      # "--ignore-scripts" (no dependency code executes), there is no caching, and permissions
+      # are empty. Keeping v4 in its own workflow isolates this from the clean main audit.
+      - name: Checkout v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: v4
+          persist-credentials: false
+
+      # The workspace above is the v4 tree, which does not contain this action — reference it
+      # from the default branch instead of the local "./" path.
+      # TODO: pin to a commit SHA once this action exists on the default branch.
+      - name: Audit dependencies
+        uses: UI5/cli/.github/actions/dependency-audit@main
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
deleted file mode 100644
index dca3db65c07..00000000000
--- a/.github/workflows/security-audit.yml
+++ /dev/null
@@ -1,102 +0,0 @@
-name: Security Audit
-
-on:
-  schedule:
-    - cron: "36 4 * * *" # Run once a day
-  workflow_dispatch:
-
-# No permissions are required for this workflow
-permissions: {}
-
-jobs:
-  security-scan:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false # Continue all jobs even if one fails
-      matrix:
-        branch: ["main", "v4"] # List of branches to run the security audit on
-
-    steps:
-      - name: Checkout '${{ matrix.branch }}' branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ matrix.branch }}
-          # This workflow runs in the privileged default-branch context (schedule / dispatch) but
-          # checks out other branches. Do not persist the GITHUB_TOKEN in the git config so the
-          # checked-out code cannot inherit push/API credentials (CodeQL cache-poisoning).
-          persist-credentials: false
-
-      # Use Node.js 24 to get npm 11 instead of npm 10. The default runner Node.js version is 22, which
-      # comes with npm 10. This could lead to different installation paths that could conflict with the
-      # allowlist in audit-ci.jsonc.
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "24"
-
-      # --ignore-scripts: never run dependency lifecycle scripts here. The audit only needs the
-      # resolved tree, and this removes execution of untrusted code in the privileged
-      # default-branch context (CodeQL cache-poisoning).
-      - name: Install dependencies
-        run: npm ci --ignore-scripts
-
-      - name: Use audit-ci
-        run: npm run audit
-
-  security-scan-latest:
-    name: "Security Audit · latest (${{ matrix.scope }}) · ${{ matrix.branch }}"
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false # Continue all jobs even if one fails
-      matrix:
-        branch: ["main", "v4"] # List of branches to run the security audit on
-        scope: ["dev + prod", "prod only"]
-        include:
-          # "dev + prod": everything the repository pulls in, resolved to latest
-          - scope: "dev + prod"
-            audit_flags: ""
-          # "prod only": exactly what consumers install, resolved to latest
-          - scope: "prod only"
-            audit_flags: "-- --skip-dev"
-
-    steps:
-      - name: Checkout '${{ matrix.branch }}' branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ matrix.branch }}
-          # This workflow runs in the privileged default-branch context (schedule / dispatch) but
-          # checks out other branches. Do not persist the GITHUB_TOKEN in the git config so the
-          # checked-out code cannot inherit push/API credentials (CodeQL cache-poisoning).
-          persist-credentials: false
-
-      # Use Node.js 24 to get npm 11 instead of npm 10. The default runner Node.js version is 22, which
-      # comes with npm 10. This could lead to different installation paths that could conflict with the
-      # allowlist in audit-ci.jsonc.
-      - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "24"
-
-      # Drop the lockfile so npm re-resolves every range to the latest satisfying version.
-      # Unlike the pinned "npm ci" audit above, this reflects what actually lands in a fresh
-      # installation today (we publish without a lockfile), so we can react to new advisories
-      # before Dependabot bumps the committed package-lock.json.
-      #
-      # We install the full tree (including devDependencies) on purpose: audit-ci is itself a
-      # devDependency, so "--omit=dev" would remove the audit tool. The audit scope is instead
-      # controlled by the "--skip-dev" flag below, which filters the dependency graph npm audit
-      # reads from the lockfile — it does not require devDependencies to be absent from disk.
-      #
-      # --ignore-scripts: never run dependency lifecycle scripts here. The audit only needs the
-      # resolved tree, and this removes execution of untrusted code in the privileged
-      # default-branch context (CodeQL cache-poisoning).
-      - name: Resolve latest dependencies (ignore lockfile)
-        run: |
-          rm -rf node_modules package-lock.json
-          npm install --no-audit --no-fund --ignore-scripts
-
-      # For the "prod only" scope, "--skip-dev" makes audit-ci pass "--omit=dev" to npm audit so
-      # only the production dependencies consumers receive are audited.
-      - name: Use audit-ci
-        run: npm run audit ${{ matrix.audit_flags }}

From 536a7af2d0921b26acf89ea26f4a4517f060c6f8 Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Thu, 8 Oct 2026 10:33:28 +0300
Subject: [PATCH 4/6] feat: Enable mutli repo scan

Keep in mind that there will be CodeQL security advisories here.
It's just for testing purposes
---
 .github/workflows/security-audit-all.yml | 61 ++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 .github/workflows/security-audit-all.yml

diff --git a/.github/workflows/security-audit-all.yml b/.github/workflows/security-audit-all.yml
new file mode 100644
index 00000000000..dfcbae25324
--- /dev/null
+++ b/.github/workflows/security-audit-all.yml
@@ -0,0 +1,61 @@
+name: Security Audit (all projects)
+
+# Central, on-demand security audit across several UI5 projects. Each matrix entry checks out a
+# project at a given branch and runs the shared dependency-audit action (locked + latest · dev+prod
+# + latest · prod-only). Add a project by adding a matrix entry; a project with several branches
+# gets one entry per branch.
+#
+# Note: auditing other repositories/branches means checking out code other than this workflow's own
+# ref, which CodeQL reports as a potential cache-poisoning source. It is accepted here — the refs are
+# fixed, trusted UI5 repositories, the audit runs with "--ignore-scripts" (no dependency code runs),
+# there is no caching, and permissions are empty.
+
+on:
+  workflow_dispatch:
+
+# No permissions are required: the audited repositories are public and checked out read-only.
+permissions: {}
+
+jobs:
+  audit:
+    name: "${{ matrix.repository }}@${{ matrix.ref }}"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false # audit every project even if one fails
+      matrix:
+        include:
+          # Projects without an "audit" npm script use native "npm audit" (prod scope: --omit=dev).
+          - repository: UI5/mcp-server
+            ref: main
+            audit-command: npm audit
+            prod-only-args: --omit=dev
+          - repository: UI5/linter
+            ref: main
+            audit-command: npm audit
+            prod-only-args: --omit=dev
+          # UI5/cli audits via audit-ci (prod scope: audit-ci's --skip-dev).
+          - repository: UI5/cli
+            ref: main
+            audit-command: npm run audit
+            prod-only-args: -- --skip-dev
+          - repository: UI5/cli
+            ref: v4
+            audit-command: npm run audit
+            prod-only-args: -- --skip-dev
+
+    steps:
+      - name: Checkout ${{ matrix.repository }}@${{ matrix.ref }}
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ matrix.repository }}
+          ref: ${{ matrix.ref }}
+          persist-credentials: false
+
+      # The workspace above is the audited project, which does not contain this action — reference
+      # it from UI5/cli instead of the local "./" path.
+      # TODO: pin to a commit SHA once this action exists on the default branch.
+      - name: Audit dependencies
+        uses: UI5/cli/.github/actions/dependency-audit@main
+        with:
+          audit-command: ${{ matrix.audit-command }}
+          prod-only-args: ${{ matrix.prod-only-args }}

From 07f968b089015dad080a4f64c19b264c7bd2974c Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Thu, 8 Oct 2026 14:11:13 +0300
Subject: [PATCH 5/6] refactor: Use audit-ci and do a comparison summary

---
 .github/actions/dependency-audit/action.yml |  17 +--
 .github/actions/dependency-audit/audit.sh   | 133 ++++++++++++++++----
 2 files changed, 111 insertions(+), 39 deletions(-)

diff --git a/.github/actions/dependency-audit/action.yml b/.github/actions/dependency-audit/action.yml
index 388b9b801e8..3007f7b4267 100644
--- a/.github/actions/dependency-audit/action.yml
+++ b/.github/actions/dependency-audit/action.yml
@@ -1,20 +1,14 @@
 name: "Dependency security audit"
 description: >
-  Audits the already-checked-out project's dependencies in three scopes — locked (npm ci),
-  latest (dev + prod), and latest (production only) — so a repository can see what its committed
-  lockfile pins versus what a fresh install resolves to today. Operates on the current workspace;
-  the caller is responsible for the checkout.
+  Audits the already-checked-out project's dependencies with audit-ci in three scopes — locked
+  (npm ci), latest (dev + prod), and latest (production only) — honouring the repository's own
+  audit-ci config (auto-detected). Operates on the current workspace; the caller performs the
+  checkout.
 
 inputs:
   node-version:
     description: "Node.js version to set up (npm 11+ recommended for stable audit paths)."
     default: "24"
-  audit-command:
-    description: "Command that runs the audit and exits non-zero on findings."
-    default: "npm run audit"
-  prod-only-args:
-    description: "Extra arguments appended to audit-command for the production-only scope."
-    default: "-- --skip-dev"
 
 runs:
   using: composite
@@ -26,7 +20,4 @@ runs:
 
     - name: Run dependency audit (all scopes)
       shell: bash
-      env:
-        AUDIT_COMMAND: ${{ inputs.audit-command }}
-        PROD_ONLY_ARGS: ${{ inputs.prod-only-args }}
       run: bash "${{ github.action_path }}/audit.sh"
diff --git a/.github/actions/dependency-audit/audit.sh b/.github/actions/dependency-audit/audit.sh
index e3496ae7345..484ea2e3c92 100644
--- a/.github/actions/dependency-audit/audit.sh
+++ b/.github/actions/dependency-audit/audit.sh
@@ -1,36 +1,54 @@
 #!/usr/bin/env bash
 #
-# Audits the current workspace's dependencies in three scopes and reports each one.
-# All scopes always run; the script exits non-zero if any scope reported advisories.
+# Audits the current workspace's dependencies with audit-ci in three scopes, reports each one,
+# and writes a comparison table to the GitHub job summary (or stdout when run locally).
 #
 #   locked · ci (dev + prod)   What the committed package-lock.json pins — the reproducible
 #                              tree we build and test against.
-#   latest (dev + prod)        What the whole repo resolves to today when the lockfile is
-#                              ignored — early warning across everything we pull in.
-#   latest (prod only)         What a fresh install gives consumers today (we publish without
-#                              a lockfile) — the scope that reaches end users.
+#   latest (dev + prod)        What the repo resolves to today with the lockfile ignored —
+#                              early warning across everything we pull in.
+#   latest (prod only)         What a fresh install gives consumers today (production deps only).
 #
-# npm resolves "latest" by re-installing after the lockfile is removed. "--ignore-scripts" is
-# used everywhere: the audit only needs the resolved dependency tree, and never executing
-# dependency lifecycle code keeps this safe to run on untrusted/unpinned versions.
+# audit-ci runs every scope, so each repository/branch's own audit-ci config (allowlist, severity
+# threshold, registry) is honoured — the config file is auto-detected from the checkout.
+# "--ignore-scripts" is used for every install: the audit only needs the resolved dependency tree,
+# and never running dependency lifecycle code keeps this safe on untrusted/unpinned versions.
 
-# Note: no "-e" — a failing scope must not stop the remaining scopes from running.
+# No "-e": a failing scope must not stop the remaining scopes from running.
 set -uo pipefail
 
-AUDIT_COMMAND="${AUDIT_COMMAND:-npm run audit}"
-PROD_ONLY_ARGS="${PROD_ONLY_ARGS:- -- --skip-dev}"
+work="$(mktemp -d)"
+trap 'rm -rf "${work}"' EXIT
 
 failed=0
 
-# run_scope <label> <command...>
-run_scope() {
-	local label="$1"
-	shift
+# Auto-detect this repo/branch's audit-ci config so audit-ci honours it (allowlist, levels, ...).
+config_file=""
+config_arg=""
+for f in audit-ci.jsonc audit-ci.json .audit-ci.jsonc .audit-ci.json; do
+	if [ -f "${f}" ]; then
+		config_file="${f}"
+		config_arg="--config ${f}"
+		echo "Using audit-ci config: ${f}"
+		break
+	fi
+done
+
+# audit_scope <label> <snapshot-name> [extra audit-ci args]
+# Runs audit-ci once per scope: its exit code gates pass/fail, its JSON output feeds the summary.
+audit_scope() {
+	local label="$1" name="$2"
+	shift 2
+	local rc=0
 	echo "::group::Audit — ${label}"
-	if "$@"; then
-		echo "✓ ${label}: no blocking advisories"
+	# shellcheck disable=SC2086 # intentional word-splitting of config_arg
+	npx --yes audit-ci ${config_arg} "$@" --output-format json \
+		> "${work}/${name}.json" 2> "${work}/${name}.log" || rc=$?
+	cat "${work}/${name}.log" 2>/dev/null || true
+	if [ "${rc}" -eq 0 ]; then
+		echo "✓ ${label}: passed"
 	else
-		echo "✗ ${label}: advisories found"
+		echo "✗ ${label}: audit-ci reported findings (exit ${rc})"
 		failed=1
 	fi
 	echo "::endgroup::"
@@ -38,17 +56,80 @@ run_scope() {
 
 # 1) Locked tree, as committed.
 npm ci --ignore-scripts
-# shellcheck disable=SC2086 # intentional word-splitting of the configured command
-run_scope "locked · ci (dev + prod)" ${AUDIT_COMMAND}
+audit_scope "locked · ci (dev + prod)" locked
 
 # Re-resolve every range to its latest satisfying version.
 rm -rf node_modules package-lock.json
 npm install --no-audit --no-fund --ignore-scripts
 
-# 2) Latest, full tree. 3) Latest, production only (same install, narrower audit scope).
-# shellcheck disable=SC2086
-run_scope "latest (dev + prod)" ${AUDIT_COMMAND}
-# shellcheck disable=SC2086
-run_scope "latest (prod only)" ${AUDIT_COMMAND} ${PROD_ONLY_ARGS}
+# 2) Latest, full tree. 3) Latest, production only (same install, narrower scope).
+audit_scope "latest (dev + prod)" devprod
+audit_scope "latest (prod only)" prod --skip-dev
+
+# --- Comparison summary ---------------------------------------------------------
+# Advisory ids the repo config allowlists, so the table matches audit-ci's effective verdict.
+allowlist="${work}/allowlist.txt"
+: > "${allowlist}"
+if [ -n "${config_file}" ]; then
+	# shellcheck disable=SC2016 # this is a Node.js program, not shell — no expansion wanted
+	node -e '
+		const fs = require("fs");
+		const text = fs.readFileSync(process.argv[1], "utf8")
+			.replace(/\/\*[\s\S]*?\*\//g, "")      // strip block comments
+			.replace(/(^|[^:])\/\/.*$/gm, "$1");   // strip line comments (keep http://)
+		const cfg = JSON.parse(text);
+		for (const entry of (cfg.allowlist || [])) {
+			console.log(String(entry).split("|")[0]); // advisory id, before any "|path"
+		}
+	' "${config_file}" > "${allowlist}" 2>/dev/null || true
+fi
+
+# extract <snapshot>: "ghsa <tab> package <tab> severity <tab> url", allowlisted ids removed.
+extract() {
+	jq -r --rawfile allow "${allowlist}" '
+		($allow | split("\n") | map(select(length > 0))) as $al
+		| [ (.advisories // {}) | to_entries[] | .value.via[]?
+		    | select(type == "object")
+		    | {g: ((.url // ("src-" + (.source|tostring))) | sub(".*/"; "")),
+		       p: .name, s: .severity, u: (.url // "")} ]
+		| map(select(.g as $g | ($al | index($g)) == null))
+		| unique_by(.g)[] | [.g, .p, .s, .u] | @tsv
+	' "${work}/$1.json" 2>/dev/null || true
+}
+extract prod    > "${work}/prod.tsv"
+extract locked  > "${work}/locked.tsv"
+extract devprod > "${work}/devprod.tsv"
+
+# Join per advisory, mark presence per scope, sort ships-first then by severity.
+rows="$(
+	{
+		awk -F'\t' '{print $1"\t1\t"$2"\t"$3"\t"$4}' "${work}/prod.tsv"
+		awk -F'\t' '{print $1"\t2\t"$2"\t"$3"\t"$4}' "${work}/locked.tsv"
+		awk -F'\t' '{print $1"\t3\t"$2"\t"$3"\t"$4}' "${work}/devprod.tsv"
+	} | awk -F'\t' '
+		{ g=$1; col=$2; pkg[g]=$3; sev[g]=$4; url[g]=$5; seen[g]=1; have[g SUBSEP col]=1 }
+		END {
+			rank["critical"]=0; rank["high"]=1; rank["moderate"]=2; rank["low"]=3; rank["info"]=4
+			for (g in seen) {
+				p=(have[g SUBSEP 1]?"✓":"–"); l=(have[g SUBSEP 2]?"✓":"–"); d=(have[g SUBSEP 3]?"✓":"–")
+				adv=(url[g]!=""?"["g"]("url[g]")":g)
+				sr=(sev[g] in rank)?rank[sev[g]]:4
+				ships=(have[g SUBSEP 1]?0:1)
+				printf "%d%d\t| %s | `%s` | %s | %s | %s | %s |\n", ships, sr, adv, pkg[g], sev[g], p, l, d
+			}
+		}' | sort | cut -f2-
+)"
+
+{
+	echo "## Security audit comparison"
+	echo
+	echo "| Advisory | Package | Severity | prod · latest (ships) | locked · ci | dev + prod · latest |"
+	echo "|---|---|---|:--:|:--:|:--:|"
+	if [ -n "${rows}" ]; then echo "${rows}"; else echo "| _none_ | | | | | |"; fi
+	echo
+	echo "**How to read:** \`✓\` under **prod · latest** reaches a fresh install today — fix first." \
+		"A row \`✓\` only under **locked · ci** clears by refreshing the lockfile." \
+		"Advisories allowlisted in this repo's audit-ci config are excluded."
+} >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
 
 exit "${failed}"

From f2d6adef10a7d1b1316ff12b9846b607ac146f92 Mon Sep 17 00:00:00 2001
From: d3xter666 <yavor.ivanov@sap.com>
Date: Thu, 8 Oct 2026 14:11:38 +0300
Subject: [PATCH 6/6] feat: Include external projects and check all

---
 .github/workflows/security-audit-all.yml | 18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/security-audit-all.yml b/.github/workflows/security-audit-all.yml
index dfcbae25324..1228cc86001 100644
--- a/.github/workflows/security-audit-all.yml
+++ b/.github/workflows/security-audit-all.yml
@@ -2,8 +2,9 @@ name: Security Audit (all projects)
 
 # Central, on-demand security audit across several UI5 projects. Each matrix entry checks out a
 # project at a given branch and runs the shared dependency-audit action (locked + latest · dev+prod
-# + latest · prod-only). Add a project by adding a matrix entry; a project with several branches
-# gets one entry per branch.
+# + latest · prod-only), which audits via audit-ci and honours each repo/branch's own audit-ci
+# config. Add a project by adding a matrix entry; a project with several branches gets one entry
+# per branch.
 #
 # Note: auditing other repositories/branches means checking out code other than this workflow's own
 # ref, which CodeQL reports as a potential cache-poisoning source. It is accepted here — the refs are
@@ -24,24 +25,14 @@ jobs:
       fail-fast: false # audit every project even if one fails
       matrix:
         include:
-          # Projects without an "audit" npm script use native "npm audit" (prod scope: --omit=dev).
           - repository: UI5/mcp-server
             ref: main
-            audit-command: npm audit
-            prod-only-args: --omit=dev
           - repository: UI5/linter
             ref: main
-            audit-command: npm audit
-            prod-only-args: --omit=dev
-          # UI5/cli audits via audit-ci (prod scope: audit-ci's --skip-dev).
           - repository: UI5/cli
             ref: main
-            audit-command: npm run audit
-            prod-only-args: -- --skip-dev
           - repository: UI5/cli
             ref: v4
-            audit-command: npm run audit
-            prod-only-args: -- --skip-dev
 
     steps:
       - name: Checkout ${{ matrix.repository }}@${{ matrix.ref }}
@@ -56,6 +47,3 @@ jobs:
       # TODO: pin to a commit SHA once this action exists on the default branch.
       - name: Audit dependencies
         uses: UI5/cli/.github/actions/dependency-audit@main
-        with:
-          audit-command: ${{ matrix.audit-command }}
-          prod-only-args: ${{ matrix.prod-only-args }}