chore(deps): bump the non-critical group across 1 directory with 20 updates #659
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: dependency-security-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| npm-audit: | |
| name: npm audit (${{ matrix.workspace }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| workspace: | |
| - backend | |
| - frontend | |
| - api | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Audit npm production dependencies (fail on high/critical) | |
| # Single root lockfile (npm workspaces): audit from the root, scoped to | |
| # the workspace with -w. `npm audit` inside a workspace dir has no lockfile. | |
| run: npm audit --audit-level=high --omit=dev -w ${{ matrix.workspace }} | |
| cargo-audit-and-deny: | |
| name: cargo audit & cargo deny (Rust) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit,cargo-deny | |
| - name: Generate Cargo.lock for audit | |
| run: cargo generate-lockfile | |
| - name: Audit Rust dependencies (cargo audit) | |
| run: cargo audit | |
| # ─── Licence compatibility (SR-101) ───────────────────────────────────────── | |
| manifest-licenses: | |
| name: Manifests declare MIT | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Check LICENSE file and every package manifest | |
| run: node scripts/check-manifest-licenses.js | |
| npm-licenses: | |
| name: npm licence compatibility | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| # Reads the committed lockfiles directly — no install needed. A copyleft | |
| # dependency (GPL/AGPL/LGPL/SSPL) would make the MIT claim in LICENSE false. | |
| - name: Check production dependency licences | |
| run: node scripts/check-dependency-licenses.js | |
| cargo-licenses: | |
| name: cargo licence compatibility (Rust) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-deny | |
| - name: Check Rust dependency licences against deny.toml | |
| run: cargo deny --all-features check licenses |