security-audit.yml

name: Security Audit

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  audit:
    name: npm audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - name: Runtime dependency audit (blocking high/critical)
        run: npm audit --omit=dev --audit-level=high
      - name: Full dependency audit (informational)
        run: |
          set +e
          npm audit --json > npm-audit-full.json
          true
      - name: Upload full audit report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: npm-audit-full
          path: npm-audit-full.json
          retention-days: 14