alexion
6081e3e325
Imported as a linear vendor commit so forge rebases do not replay the upstream root tree. git-subtree-dir: third_party/pi git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0
32 lines
737 B
YAML
32 lines
737 B
YAML
name: npm audit
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '37 7 * * *'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install dependencies without lifecycle scripts
|
|
run: npm ci --ignore-scripts --no-audit --no-fund
|
|
|
|
- name: Audit production vulnerabilities
|
|
run: node scripts/npm-audit.mjs
|
|
|
|
- name: Verify registry signatures
|
|
run: npm audit signatures --omit=dev
|