ci(workspace): add npm audit workflow to scan dependencies #171
Conversation
introduce automated security scanning for dependencies by running `npm audit` in pull requests. this ensures vulnerabilities are caught earlier in the development cycle and increases visibility for reviewers. Closes asgardeo#153
TharakaUJ
force-pushed
the
npm-audit
branch
from
542b34d to
b5b00bc
Compare
|
Hi @TharakaUJ, Thanks a lot for the PR. Just FYI, jave a look at here: #153 (comment) to understand the issue picking process of the competition. Cheers! |
|
@NipuniBhagya Could you please review this? |
Thanks for pointing me to that! I’ve gone through the comment and now understand the issue picking process. I’ll be sure to follow it properly for future contributions. |
.github/workflows/npm-audit.yml
Outdated
| audit: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code |
There was a problem hiding this comment.
Lets follow the current style of configuring CI jobs.
We usually keep a matrix of the versions such as Node.js for ease.
Have a look at the following reference and lets use the exact same style here as well.
Ref: https://github.com/asgardeo/javascript/blob/main/.github/workflows/pr-builder.yml#L18-L48
Follow the current style of configuring CI jobs as requested by reviewers: - Use matrix strategy for Node.js versions for ease of maintenance - Match the exact same style as reference pr-builder.yml workflow Addresses reviewer feedback: "Lets follow the current style of configuring CI jobs. We usually keep a matrix of the versions such as Node.js for ease."
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
introduce automated security scanning for dependencies by running
npm auditin pull requests. this ensures vulnerabilities are caught earlier in the development cycle and increases visibility for reviewers.Closes #153
Purpose
Related Issues
Related PRs
Checklist
Security checks