ci(frontend): add npm audit workflow

- Create 'frontend-audit.yaml' to fail on high-severity vulnerabilities
- Integrate audit job into main 'frontend-ci.yaml'

Signed-off-by: Davide Briani <davide.briani@secomind.com>

Author: davidebriani

.github/workflows/frontend-audit.yaml

@@ -0,0 +1,45 @@
+# This file is part of Edgehog.
+#
+# Copyright 2026 SECO Mind Srl
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+name: NPM Audit
+on:
+  workflow_call:
+  workflow_dispatch:
+permissions:
+  contents: read
+defaults:
+  run:
+    shell: bash
+    working-directory: frontend
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          show-progress: false
+      - uses: actions/setup-node@v6
+        id: cache-npm
+        with:
+          node-version-file: .tool-versions
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+      - name: npm install
+        run: npm ci --ignore-scripts
+      - name: npm audit
+        run: npm audit --audit-level=high

.github/workflows/frontend-ci.yaml

@@ -1,7 +1,7 @@
 #
 # This file is part of Edgehog.
 #
-# Copyright 2021 - 2025 SECO Mind Srl
+# Copyright 2021 - 2026 SECO Mind Srl
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -62,3 +62,6 @@ jobs:
   coverage:
     needs: [warmup-cache]
     uses: ./.github/workflows/frontend-coverage.yaml
+  audit:
+    needs: [warmup-cache]
+    uses: ./.github/workflows/frontend-audit.yaml