[PresentJay]

shx already has a Node and operating-system compatibility matrix. I tried its committed npm tree separately to see whether a downloadable advisory report would be useful alongside those behavior checks. I contribute to zero-shelter, the tool proposed here, and used AI assistance for this change and validation.

The PR adds only .github/workflows/dependency-report.yml. Maintainers choose when to run Dependency triage report using workflow_dispatch; it requests contents: read. npm audit --package-lock-only --ignore-scripts supplies one npm report to pinned zero-shelter@0.0.10, which produces HTML retained for 7 days. No project dependencies are installed, no project lifecycle scripts or shx commands are run, and no baseline is accepted. Finding exit 1 and judgement-error exit 2 fail this manual job. Node 24 is used only for this report job.

The stored capture at 3829f83e1498 contained 30 raw records, 20 merged findings and 20 outstanding findings. Audit, JSON and HTML commands exited 1. YAML, shell syntax and diff checks passed, with manifest and lockfile unchanged. This rewrite includes no fresh scan. Application tests, the compatibility matrix and a hosted manual run were not verified in that validation.

The report uses npm advisories only and makes no runtime reachability claim. Audit sends package/version metadata to the configured registry. npx downloads and executes third-party CLI code in CI; read-only repository permissions do not remove that execution risk.

Does a separate manual advisory report fit how you maintain shx? I can withdraw it if the extra workflow would be redundant.

[PresentJay]

I contribute to zero-shelter. For shx, I am proposing an optional HTML view of npm advisories alongside the existing Node and operating-system compatibility checks. Would you use a report like this when reviewing the dependency tree? I can withdraw it if the separate manual workflow would mostly duplicate your current process.