chore: 🤖 Allow known audit vulnerability to be ignored

.github/workflows/monorepo-validate.yaml

@@ -22,7 +22,7 @@ jobs:
         with:
           node-version: '12.x'
       - run: yarn install
-      - run: yarn audit
+      - run: yarn run compliance:audit
 
   lint:
     name: Lint

package.json

@@ -19,7 +19,8 @@
     "test:addons:auth": "echo \"\n\ntest: addons/auth\n\" && cd addons/auth && yarn test",
     "test:addons:rose": "echo \"\n\ntest: addons/rose\n\" && cd addons/rose && yarn test",
     "test:ui:core": "echo \"\n\ntest: ui/core\n\" && cd ui/core && yarn test",
-    "precommit": "yarn compliance:licenses && yarn audit && yarn lint && yarn test",
+    "compliance:audit": "bash ./scripts/yarn-audit.sh",
+    "precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test",
     "commit": "git-cz",
     "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'watchtower-ui;core@0.0.0;base64-js@0.0.2'",
     "doc:toc": "doctoc README.md"

scripts/yarn-audit.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Workaround to suppress yarn audit report for issues without known resolutions.
+# Audit level: Moderate
+# https://github.com/yarnpkg/yarn/issues/6669
+
+set -u
+
+set +e
+output=$(yarn audit --level=moderate --json)
+result=$?
+set -e
+
+if [ $result -eq 0 ]; then
+	# everything is fine
+	exit 0
+fi
+
+if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then
+	echo
+	echo Ignorning known vulnerabilities
+	exit 0
+fi
+
+echo
+echo Security vulnerabilities were found that were not ignored
+echo
+echo Check to see if these vulnerabilities apply to production
+echo and/or if they have fixes available. If they do not have
+echo fixes and they do not apply to production, you may ignore them
+echo
+echo To ignore these vulnerabilities, run:
+echo
+echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues"
+echo
+echo and commit the yarn-audit-known-issues file
+
+exit "$result"