Npm audit fix and create PR #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Npm audit fix and create PR | |
| on: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows | |
| # In a public repository, scheduled workflows are automatically disabled when no | |
| # repository activity has occurred in 60 days | |
| - cron: "5 6 * * 1-5" # At 06:05 on every day-of-week from Monday through Friday | |
| jobs: | |
| npm-audit-fix: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Update vulnerable node packages | |
| run: | | |
| npm audit fix | |
| - name: Create Pull Request | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 #v8 | |
| with: | |
| commit-message: "GHA: Update vulnerable node dependencies" | |
| title: Update vulnerable node dependencies | |
| body: | | |
| - Dependency node updates | |
| Auto-generated by [create-pull-request][1] | |
| [1]: https://github.com/peter-evans/create-pull-request | |
| branch: update-node-dependencies | |
| labels: automated-pr | |
| delete-branch: true |