[PM-11858] Add GitHub workflows for auditing and building PRs

[JaredScar]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-11858

📔 Objective

Add new GitHub workflows to keep DC more modernized

[github-actions]

Checkmarx One – Scan Summary & Details – e164a660-c749-470f-9d1e-4009bb73f61f

---

New Issues (2)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-31802	Npm-tar-6.2.1	details Recommended version: 7.5.11 Description: node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extr... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package
2		CVE-2026-31802	Npm-tar-7.5.9	details Recommended version: 7.5.11 Description: node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extr... Attack Vector: LOCAL Attack Complexity: LOW Vulnerable Package

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 6.79%. Comparing base (058b4b4) to head (3a15112).
⚠️ Report is 17 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #1031   +/-   ##
=====================================
  Coverage   6.79%   6.79%           
=====================================
  Files         67      67           
  Lines       2798    2798           
  Branches     483     483           
=====================================
  Hits         190     190           
  Misses      2576    2576           
  Partials      32      32           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Claude finished @JaredScar's task in 3m 8s —— View job

---

Pull Request Review: PM-11858 Add GitHub workflows for auditing and building PRs

Overview

This PR adds two new GitHub workflows (audit.yml and build-pr.yml) and updates the existing build.yml to improve CI consistency. The changes are well-structured with appropriate security hardening (pinned action SHAs, minimal permissions, persist-credentials: false).

Re-Review Summary (2026-03-11)

The previous finding regarding incomplete npm ci migration has been fully addressed in commit 565581e. All six build jobs in build.yml now consistently use npm ci instead of npm install. No new issues introduced.

No remaining findings.

What looks good:

• Both new workflows use permissions: contents: read (least privilege)
• All action references are pinned to full SHA hashes
• persist-credentials: false on all checkout steps
• HUSKY: 0 is now consistently set across all build jobs
• build-pr.yml path filters are well-scoped to avoid unnecessary CI runs
• audit.yml correctly audits both root and src-cli packages at --audit-level=high
• All npm install calls have been migrated to npm ci for reproducible builds

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
7 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jrmccannon]

If audit is supposed to be failing. Mission success