From 104c1410725856b762d525630ea33b39406f2951 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Fri, 23 Oct 2026 22:52:01 +0000
Subject: [PATCH] ci(hub): remove Bundler Audit check

Keep local auditing and the seven-day dependency policy unchanged.

Co-authored-by: Nishiki Liu <hello@nshki.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/hub-ci.yml | 13 -------------
 docs/testing-and-review.md   |  2 +-
 2 files changed, 1 insertion(+), 14 deletions(-)

diff --git a/.github/workflows/hub-ci.yml b/.github/workflows/hub-ci.yml
index 8bd35321..b9aaf8cb 100644
--- a/.github/workflows/hub-ci.yml
+++ b/.github/workflows/hub-ci.yml
@@ -109,19 +109,6 @@ jobs:
       - run: bin/rails db:prepare
       - run: bin/check-annotations
 
-  bundler_audit:
-    name: Bundler audit
-    needs: changes
-    if: ${{ needs.changes.outputs.hub == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
-        with:
-          bundler-cache: true
-          working-directory: hub
-      - run: bin/bundler-audit check --update
-
   typecheck:
     name: TypeScript types${{ matrix.node == 26 && ' (Node 26)' || '' }}
     needs: changes
diff --git a/docs/testing-and-review.md b/docs/testing-and-review.md
index 504fe329..3a510554 100644
--- a/docs/testing-and-review.md
+++ b/docs/testing-and-review.md
@@ -72,7 +72,7 @@ Hub and the shared build action wait seven days before resolving newly published
 
 Inside the Hub devcontainer, `bin/check-dependency-age` verifies the Hub npm and Bundler lockfiles. The repository-level [Dependency age workflow](../.github/workflows/dependency-age.yml) runs the same checker across Hub, the shared build action, and external GitHub Action commits. These checks cover existing lockfiles that bypass the package manager's resolver delay and fail when publication metadata is unavailable.
 
-CI does not run `npm audit`: a newly published security fix could otherwise make the audit fail while the age check rejects the fixed version. Dependabot and Bundler Audit check dependencies for known vulnerabilities. Organization-managed CodeQL scans application code on GitHub.
+GitHub CI does not run `npm audit` or Bundler Audit: a newly published security fix could otherwise make an audit fail while the age check rejects the fixed version. Dependabot checks dependencies for known vulnerabilities. Hub's local `bin/ci` still runs Bundler Audit. Organization-managed CodeQL scans application code on GitHub.
 
 When a dependency is too new, select an older compatible version or wait until the seven-day window ends. See [Hub testing and operations](../hub/docs/testing-and-operations.md#update-dependencies) for Hub-specific tooling.