ci(workspace): add npm audit workflow to scan dependencies#171
ci(workspace): add npm audit workflow to scan dependencies#171brionmario merged 2 commits intoasgardeo:mainfrom
Conversation
introduce automated security scanning for dependencies by running `npm audit` in pull requests. this ensures vulnerabilities are caught earlier in the development cycle and increases visibility for reviewers. Closes asgardeo#153
TharakaUJ
force-pushed
the
npm-audit
branch
from
542b34d to
b5b00bc
Compare
|
Hi @TharakaUJ, Thanks a lot for the PR. Just FYI, jave a look at here: #153 (comment) to understand the issue picking process of the competition. Cheers! |
|
@NipuniBhagya Could you please review this? |
Thanks for pointing me to that! I’ve gone through the comment and now understand the issue picking process. I’ll be sure to follow it properly for future contributions. |
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
| strategy: | ||
| matrix: | ||
| node-version: [lts/*] | ||
| steps: |
There was a problem hiding this comment.
Lets replace the existing steps with the existing steps from https://github.com/asgardeo/javascript/blob/main/.github/workflows/pr-builder.yml#L23C1-L66 apart from 🐳 Set SHAs for Nx.
| steps: | |
| steps: | |
| - name: ⬇️ Checkout | |
| id: checkout | |
| uses: actions/checkout@v2.3.3 |
Follow the current style of configuring CI jobs as requested by reviewers: - Use matrix strategy for Node.js versions for ease of maintenance - Match the exact same style as reference pr-builder.yml workflow Addresses reviewer feedback: "Lets follow the current style of configuring CI jobs. We usually keep a matrix of the versions such as Node.js for ease."
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. |
|
Awesome work. Thanks for the contribution. |
|
Happy to contribute. |
3 participants
introduce automated security scanning for dependencies by running
npm auditin pull requests. this ensures vulnerabilities are caught earlier in the development cycle and increases visibility for reviewers.Closes #153
Purpose
Related Issues
Related PRs
Checklist
Security checks