Remediation in scripts/post_alert_action.py is npm-only — it runs npm audit fix and reads/commits package-lock.json. On yarn repos (e.g. mozilla/fxa, no package-lock.json) it fails:
npm error code ENOLOCK ... this command requires an existing lockfile
base64: package-lock.json: No such file or directory → exit 1
Because the remediate job fails, the alert is never tagged investigated/…, so the scheduled sweep re-investigates it every ~30 min forever — a runaway cost loop with zero result.
Fix: detect the repo's package manager and use the yarn path (resolutions / yarn npm audit), or skip the bump for unsupported managers instead of failing the job.
Worked around on fxa by disabling investigation (mozilla/fxa#20949).
Remediation in
scripts/post_alert_action.pyis npm-only — it runsnpm audit fixand reads/commitspackage-lock.json. On yarn repos (e.g.mozilla/fxa, nopackage-lock.json) it fails:Because the remediate job fails, the alert is never tagged
investigated/…, so the scheduled sweep re-investigates it every ~30 min forever — a runaway cost loop with zero result.Fix: detect the repo's package manager and use the yarn path (resolutions /
yarn npm audit), or skip the bump for unsupported managers instead of failing the job.Worked around on fxa by disabling investigation (mozilla/fxa#20949).