From 2fd4d464fe41299e4a2c4374d151138381513036 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 22 Oct 2026 22:14:03 +0000 Subject: [PATCH] ci: add daily and per-PR pnpm audit check Fail on critical advisories in runtime dependencies. Runs daily too, because new advisories appear without any code change. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FPBJ9DRFq4u6eoLci23B6S --- .github/workflows/audit.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/workflows/audit.yml diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml new file mode 100644 index 00000000..652a5610 --- /dev/null +++ b/.github/workflows/audit.yml @@ -0,0 +1,32 @@ +# Fail on critical advisories in runtime dependencies. +# Runs daily too, because new advisories appear without any code change. +# https://pnpm.io/cli/audit +name: Dependency audit +on: + pull_request: + schedule: + - cron: '17 6 * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + audit: + name: pnpm audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + + - name: 'Install pnpm' + # Version is read from the "packageManager" field in package.json. + uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + + - name: 'Set up Node.js (pnpm 11 requires Node 22+)' + uses: actions/setup-node@v6 + with: + node-version: 22 + + # Reads pnpm-lock.yaml, no install needed + - name: Audit runtime dependencies + run: pnpm audit --prod --audit-level critical