Supply-chain audit #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Supply-chain cadence audit — runs the supply-chain invariants on a schedule, not | |
| # just on push/PR, so the posture is re-checked even in quiet weeks. Complements | |
| # Scorecard (weekly scoring), Dependabot (weekly version bumps), and the per-PR | |
| # dependency-review gate. See docs/SUPPLY-CHAIN.md. | |
| name: Supply-chain audit | |
| on: | |
| schedule: | |
| - cron: "0 7 * * 1" # Mondays 07:00 UTC (an hour after Scorecard) | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| name: weekly audit (npm advisories + invariants) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| - run: npm ci | |
| # Zero runtime deps (ADR-0001) means published artifacts carry no advisory | |
| # surface; this audits the DEV-tool surface. Advisory (never gates) because | |
| # a dev-dep advisory does not ship to users — but it is surfaced weekly and | |
| # written to the run summary so it can't sit unseen. Dependabot opens the | |
| # actual bump PRs. | |
| - name: npm audit (dev surface, advisory) | |
| run: | | |
| echo "## npm audit (dev dependencies)" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| npm audit --audit-level=high 2>&1 | tee -a "$GITHUB_STEP_SUMMARY" || true | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| # These DO gate: they are project invariants, not third-party advisories. | |
| - name: Enforce zero runtime dependencies (ADR-0001) | |
| run: node scripts/check-zero-deps.mjs | |
| - name: Enforce SHA-pinned GitHub Actions | |
| run: node scripts/check-action-pins.mjs | |
| - name: Enforce the offline/agent boundary (ADR-0005) | |
| run: node scripts/check-offline-boundary.mjs |