[PresentJay]

basic-auth already has CodeQL, Scorecard and release checks. I contribute to zero-shelter and proposed a trial of its manual HTML report for the package's locked development toolchain; the manifest declares no regular runtime dependencies.

The sole changed file is .github/workflows/dependency-report.yml. It runs only through workflow_dispatch, requests contents: read, and uses SHA-pinned official actions plus pinned zero-shelter@0.0.10. npm audit --package-lock-only --ignore-scripts supplies the input; generated HTML is retained for 7 days. Finding exit 1 and scanner/judgement-error exit 2 both fail the job. It installs no project dependencies, accepts no baseline and changes no existing gate or publishing behavior.

A saved capture from 2 November 2026 at 301fe415bd5c produced 17 raw / 17 merged / 17 outstanding findings, 0 accepted. npm audit and JSON/HTML exited 1; a failed-scanner control exited 2. YAML, Bash and whitespace checks passed, and manifest/lockfile hashes were unchanged. These are dated results, not a new scan. Application test/build checks and the new hosted manual workflow remain untested.

Only npm audit is used; authentication correctness and code reachability are untested. npm audit sends dependency metadata to the configured registry, and npx downloads and executes the third-party CLI in CI. I used AI assistance to prepare this work and description.

Would a manual report fit your current maintenance workflow? I'm happy to withdraw it if it duplicates what you already use.

[PresentJay]

I work on zero-shelter and am trying its manual report for basic-auth’s locked development toolchain. This is an npm advisory view alongside the existing CodeQL and Scorecard checks, rather than a test of authentication behavior. Would it be useful in your maintenance workflow, or mostly duplicate your current review?

[blakeembrey]

Not at this point in time, thanks! I don't think it'd be something I run, and it'd be an extra thing to maintain.