fix(deps): pin vulnerable transitive dependencies, add bun audit CI

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -40,7 +40,7 @@ jobs:
   docker-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
 
       - name: Build compose images (demo-services + argus-server, which builds the UI)
         run: docker compose build

.github/workflows/pr-title.yml

@@ -0,0 +1,36 @@
+name: PR Title
+
+# Lints the PR title against Conventional Commits. This matters most on a
+# squash merge, where the squash commit message defaults to the PR title —
+# argus also allows merge and rebase merges, where individual commits land
+# as-is, so this doesn't guarantee every commit on main complies, only the
+# PR title itself.
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+concurrency:
+  group: pr-title-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            chore
+            docs
+            refactor
+            test
+            ci
+          requireScope: false

.github/workflows/vulncheck.yml

@@ -0,0 +1,37 @@
+name: Vulnerabilities
+
+# Its own workflow because it is the one check whose result can change without the
+# repository changing: a newly published advisory against an unchanged dependency only
+# surfaces on a scheduled run. bun.lock isn't parsed by GitHub's dependency graph, so
+# Dependabot alerts don't cover this repo — bun audit is what actually catches it.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, off the hour to avoid the top-of-hour scheduling crowd.
+    - cron: "17 4 * * 1"
+  # So an advisory can be checked without waiting for the next scheduled run.
+  workflow_dispatch:
+
+jobs:
+  vulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.6"
+
+      # Each has its own bun.lock (root, server, UI aren't one bun workspace), so each
+      # gets its own audit. Reads the lockfile directly — no install needed.
+      - name: Audit — root
+        run: bun audit
+
+      - name: Audit — server
+        run: bun audit --cwd argus-server
+
+      - name: Audit — UI
+        run: bun audit --cwd argus-ui

SECURITY.md

@@ -0,0 +1,20 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please don't open a public issue for a security problem.
+
+Use [GitHub's private vulnerability reporting](https://github.com/sdOps/argus/security/advisories/new) instead, from the repo's **Security** tab ("Report a vulnerability").
+This opens a private advisory visible only to you and the maintainers, so the issue can be discussed and fixed before it's public.
+
+We'll acknowledge a new report within a few days and follow up with next steps once we've assessed it.
+
+## Scope
+
+Argus is a headless agent that runs a server: argus-server exposes a REST API, a WebSocket, and a webhook receiver (Alertmanager alerts in), and it drives an LLM-backed agent that can call tools, including ones that execute remediation actions against the monitored stack.
+The most relevant vulnerability classes here are things like: unauthenticated or under-authorized access to the API/WebSocket/webhook endpoints; a crafted alert or tool result that leads to prompt injection or an unintended tool call; secrets (LLM provider keys, webhook URLs) leaking via logs or responses; or a dependency with a known, reachable vulnerability (tracked via `bun audit`, see `.github/workflows/vulncheck.yml`).
+
+## Supported versions
+
+Argus is pre-1.0 and does not yet maintain multiple release branches.
+Fixes land on `main`; there's no backport policy at this stage.

argus-server/package.json

@@ -16,5 +16,10 @@
   "devDependencies": {
     "@types/bun": "^1.2.0",
     "typescript": "^5.7.0"
+  },
+  "overrides": {
+    "brace-expansion": "^5.0.12",
+    "protobufjs": "^7.6.6",
+    "undici": "^8.10.2"
   }
 }

argus-ui/package.json

@@ -23,5 +23,9 @@
     "tailwindcss": "^4.3.0",
     "typescript": "^5.7.0",
     "vite": "^8.0.16"
+  },
+  "overrides": {
+    "nanoid": "^3.3.19",
+    "postcss": "^8.5.28"
   }
 }

package.json

@@ -5,5 +5,8 @@
   "type": "module",
   "devDependencies": {
     "concurrently": "^9.2.0"
+  },
+  "overrides": {
+    "shell-quote": "^1.10.0"
   }
 }