Dependency audit #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency audit | |
| # Full-tree `npm audit` for ambient advisories (vulnerabilities in deps no PR | |
| # touched). This is intentionally NOT a per-PR gate: PRs are gated on the | |
| # vulnerabilities they introduce via the dependency-review job in ci.yml, and | |
| # Renovate (vulnerabilityAlerts) + GitHub Dependabot alerts open the fix PRs. | |
| # This run keeps the whole tree under active audit on a cadence and on demand. | |
| on: | |
| schedule: | |
| - cron: "0 16 * * 1" # Mondays 16:00 UTC (~9am America/Phoenix), aligns with Renovate | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: audit | |
| cancel-in-progress: true | |
| jobs: | |
| audit: | |
| name: audit | |
| runs-on: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true) && 'ubuntu-latest' || 'self-hosted' }} | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - name: Setup Node | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Full dependency audit | |
| run: npm audit --audit-level=moderate |