[JuroUhlar]

Part of INTER-2697.

Why

Catch critical advisories in runtime dependencies on every PR and daily, since new advisories appear without code changes.

Things to note

• The published SDK has no runtime dependencies; dist/ imports only Node built-ins (crypto, zlib, util, buffer). So --prod currently covers the dependencies of the private workspace packages example/ and tests/functional-tests/ (dotenv). devDependencies are not checked.
• Main has no critical advisories (full audit: 32 high, 13 moderate, 2 low, 0 critical), so no dependency changes and no changeset.
• Peer warnings (typescript for openapi-typescript, @types/node for vitest/vite) exist on main and are unchanged.

Verification

Ran against the main lockfile in a scratch dir with no node_modules:

Case	--prod --audit-level critical	Full --audit-level critical
main lockfile	exit 0	exit 0
minimist@0.0.8 added to example deps	exit 1 (GHSA-xvch-5gv4-984h)	-
minimist@0.0.8 added to root devDeps	exit 0 (skipped)	exit 1

Locally: pnpm lint, pnpm typecheck:source, pnpm test:dts, pnpm test (132 passed) and pnpm build all pass.

Change outline

• .github/workflows/audit.yml (new): runs pnpm audit --prod --audit-level critical on pull_request, daily at 06:17 UTC and on manual dispatch. Uses the same pinned pnpm/action-setup and Node 22 as functional_tests.yml. No install step; the audit reads pnpm-lock.yaml.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2fd4d46

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

⚠️ This PR doesn't contain any changesets. If there are user-facing changes, don't forget to run:

pnpm exec changeset

to create a changeset.

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	98.25%	168/171
🟢	Branches	97.03%	98/101
🟢	Functions	100%	37/37
🟢	Lines	98.21%	165/168

Test suite run success

132 tests passing in 30 suites.

Report generated by 🧪jest coverage report action from 2fd4d46

Show full coverage report

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟢	All files	98.24	97.02	100	98.21
🟢	src	98.54	98.76	100	98.51
🔴	...edApiTypes.ts	0	0	0	0
🔴	index.ts	0	0	0	0
🟢	sealedResults.ts	100	100	100	100
🟢	...rApiClient.ts	96.15	97.22	100	96.15	360,364
🟢	types.ts	100	100	100	100
🟢	urlUtils.ts	100	100	100	100
🟢	webhook.ts	100	100	100	100
🟢	src/errors	97.05	90	100	96.96
🟢	apiErrors.ts	100	100	100	100
🟢	...orResponse.ts	100	100	100	100
🟢	toError.ts	87.5	88.88	100	87.5	21
🟢	unsealError.ts	100	50	100	100	14

[Copilot]

🟢 Approval recommended

The workflow matches the intended triggers and audit scope, with no identified blocking issues.

No open issues 🎉

What changed in this PR

Adds automated checks for critical advisories in production dependencies, including newly published advisories that appear without code changes.

Changes:

• Runs on every pull request, daily at 06:17 UTC, and through manual dispatch.
• Uses pinned pnpm setup and Node.js 22.
• Audits the lockfile without installing dependencies; devDependencies are excluded.

File	Description
.github/​workflows/​audit.yml	Adds the scheduled and per-PR production dependency audit.

_{Review effort: Balanced}