fix(ci): resync web lockfile blocking Trivy

[Copilot]

Canonical issue

Root/workspace lockfile drift blocked the trivy job before Trivy could start. The failure was in the repo root Docker build path, not in the Python-only PRs that surfaced it.

Outcome

Security Scan can get past the web workspace install step again and reach Trivy.

• Build path unblocked
  • The canonical lockfile now matches the current apps/web manifest for the OpenTelemetry additions that were missing from the lock.
• Operational result
  • npm ci --workspace=apps/web --production --legacy-peer-deps succeeds inside the root Docker build, so Trivy can execute and emit findings.

RUN npm ci --workspace=apps/web --production --legacy-peer-deps

Scope

• Included:
  • Root workspace lockfile resync for the current apps/web dependency graph
  • Recovery of the Security Scan Docker → npm ci → Trivy path
• Explicitly excluded:
  • Unrelated dependency upgrades
  • Manifest refactors or workflow redesign
  • Merge/deploy decisions
  • Re-run of historical failed jobs

Risk

• Risk level: low
• Failure mode:
  • Lockfile regenerated with unintended package movement outside the current manifest set
• Rollback:
  • Revert the lockfile-only sync commit

Verification

List exact automated and manual checks, tied to the current head SHA 6fda5e8.

• Focused tests
  • npx -y npm@10.8.0 ci --workspace=apps/web --production --legacy-peer-deps
  • docker build -t eventrelay:test -f Dockerfile .
  • trivy image --severity CRITICAL,HIGH --ignore-unfixed eventrelay:test
• Required CI
• Review threads resolved

Production evidence

Not applicable. This change is CI/infrastructure repair for the Security Scan path; no production behavior or deployment surface changes.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes fix(ci): resync web lockfile blocking Trivy #1657

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 12, 2026 10:31am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 26b422e4-b857-4f1b-bce2-c9f994e51ee2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 0cd8fce.

Ensure that dependencies are being submitted on PR branches. Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

🔴 E2E Test Results: FAILURE DETECTED

Metric	Value
Status	🔴 RED
Total Tests	6
Passed	11
Failed	6
Deployment	https://v0-uvai-8i9nqmb5m-garv1.vercel.app

Test Output

2m''�[39m�[33m;�[39m
    �[90m190|�[39m       �[34mexpect�[39m(ct)�[33m.�[39m�[34mtoContain�[39m(�[32m'text/event-stream'�[39m)�[33m;�[39m

�[31m�[2m⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[3/6]⎯�[22m�[39m

�[41m�[1m FAIL �[22m�[49m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mSSE Pipeline Stream�[2m > �[22mSSE stream emits at least a pipeline_status:running event
�[31m�[1mAssertionError�[22m: expected 0 to be greater than or equal to 1�[39m
�[36m �[2m❯�[22m tests/e2e/pipeline.test.ts:�[2m208:29�[22m�[39m
    �[90m206|�[39m
    �[90m207|�[39m       �[90m// Must have at least 1 event�[39m
    �[90m208|�[39m       �[34mexpect�[39m(events�[33m.�[39mlength)�[33m.�[39m�[34mtoBeGreaterThanOrEqual�[39m(�[34m1�[39m)�[33m;�[39m
    �[90m   |�[39m                             �[31m^�[39m
    �[90m209|�[39m
    �[90m210|�[39m       �[90m// Must start with pipeline_status:running�[39m

�[31m�[2m⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[4/6]⎯�[22m�[39m

�[41m�[1m FAIL �[22m�[49m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mError Handling�[2m > �[22mmissing URL returns 400, not a hang
�[31m�[1mAssertionError�[22m: expected 401 to be 400 // Object.is equality�[39m

�[32m- Expected�[39m
�[31m+ Received�[39m

�[32m- 400�[39m
�[31m+ 401�[39m

�[36m �[2m❯�[22m tests/e2e/pipeline.test.ts:�[2m358:26�[22m�[39m
    �[90m356|�[39m
    �[90m357|�[39m       �[35mconst�[39m elapsed �[33m=�[39m �[33mDate�[39m�[33m.�[39m�[34mnow�[39m() �[33m-�[39m start�[33m;�[39m
    �[90m358|�[39m       �[34mexpect�[39m(res�[33m.�[39mstatus)�[33m.�[39m�[34mtoBe�[39m(�[34m400�[39m)�[33m;�[39m
    �[90m   |�[39m                          �[31m^�[39m
    �[90m359|�[39m       �[34mexpect�[39m(elapsed)�[33m.�[39m�[34mtoBeLessThan�[39m(�[34m5_000�[39m)�[33m;�[39m �[90m// Should respond instantly�[39m
    �[90m360|�[39m     })�[33m;�[39m

�[31m�[2m⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[5/6]⎯�[22m�[39m

�[41m�[1m FAIL �[22m�[49m tests/e2e/pipeline.test.ts�[2m > �[22mEventRelay E2E — Live Deployment�[2m > �[22mAPI Health�[2m > �[22mPOST /api/pipeline/stream with no body returns 400
�[31m�[1mAssertionError�[22m: expected [ 400, 500 ] to include 200�[39m
�[36m �[2m❯�[22m tests/e2e/pipeline.test.ts:�[2m441:26�[22m�[39m
    �[90m439|�[39m       )�[33m;�[39m
    �[90m440|�[39m       �[90m// Should handle gracefully — 400 or 500, but respond quickly�[39m
    �[90m441|�[39m       �[34mexpect�[39m([�[34m400�[39m�[33m,�[39m �[34m500�[39m])�[33m.�[39m�[34mtoContain�[39m(res�[33m.�[39mstatus)�[33m;�[39m
    �[90m   |�[39m                          �[31m^�[39m
    �[90m442|�[39m     })�[33m;�[39m
    �[90m443|�[39m   })�[33m;�[39m

�[31m�[2m⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[6/6]⎯�[22m�[39m


�[2m Test Files �[22m �[1m�[31m1 failed�[39m�[22m�[90m (1)�[39m
�[2m      Tests �[22m �[1m�[31m6 failed�[39m�[22m�[2m | �[22m�[1m�[32m11 passed�[39m�[22m�[90m (17)�[39m
�[2m   Start at �[22m 11:36:14
�[2m   Duration �[22m 3.06s�[2m (transform 52ms, setup 0ms, import 69ms, tests 2.86s, environment 0ms)�[22m