fix(ci): publish PR plugin after unrelated failures - #2046

🤖 I have created a release *beep* *boop*
---


## [4.36.0](v4.35.1...v4.36.0)
(2026-07-21)


### Features

* add docker restart mutation
([#2022](#2022))
([b58120c](b58120c))
* update dependencies
([#2028](#2028))
([1c8522d](1c8522d))


### Bug Fixes

* **ci:** publish PR plugin after unrelated failures
([#2046](#2046))
([a2b0833](a2b0833))
* **ci:** resolve PR number for fork PR plugin uploads
([#2040](#2040))
([a086778](a086778))
* **ui:** smooth notification drawer slide-in/out
([#2038](#2038))
([66e86fe](66e86fe))
* **web:** send CSRF token on fetch-based webGUI requests
([#2039](#2039))
([8cb15f1](8cb15f1))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Summary
The `Audit Dependencies` job (`pnpm run audit --prod`) fails the entire
**CI - Main (API)** workflow whenever a transitive production dependency
has an open advisory. This turned the [4.36.0 release
run](https://github.com/unraid/api/actions/runs/29869430785) red over
unrelated advisories (`hono`, `fast-uri`, `immutable`) and required
manual recovery of the production publish. This change marks the audit
job `continue-on-error` so it can never block a release again.

## Why This Exists
`audit` is not in any publish job's `needs`, so it doesn't gate
publishing through the dependency graph — it blocks by turning the
**aggregate workflow conclusion** red, which branch protection,
downstream `workflow_run` gates, and humans all key off of. This is the
same class of failure already patched for PR plugin previews in #2046,
whose commit note reads: *"an Audit Dependencies failure made the
aggregate workflow conclusion fail."* Rather than papering over the
three current advisories in the ignore list, this keeps the audit fully
decoupled from the publish path.

## Resolution
Add `continue-on-error: true` to the `audit` job. The audit still runs
on every PR and push and still surfaces vulnerable dependencies as step
annotations and logs, but a finding no longer fails the workflow.

## Behavior Changes
- A dependency advisory no longer fails **CI - Main (API)** or blocks a
release/publish.
- The `Audit Dependencies` job now reports success (with the failing
step annotated) even when advisories are present.

## Trade-off
The audit becomes advisory-only: a genuinely high/critical advisory will
also no longer block a release. Individual advisories can still be
triaged/suppressed via the existing `pnpm.auditConfig` (`ignoreCves` /
`ignoreGhsas`) mechanism in `package.json` if a hard gate on specific
CVEs is ever wanted.

## Verification
- `actionlint .github/workflows/main.yml` reports only pre-existing
shellcheck/type notes in untouched jobs; no new issues from this change.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Dependency audit checks are now advisory and will no longer block the
workflow when issues are detected.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->