Skip to content

Supply-chain audit

Supply-chain audit #6

# Supply-chain cadence audit — runs the supply-chain invariants on a schedule, not
# just on push/PR, so the posture is re-checked even in quiet weeks. Complements
# Scorecard (weekly scoring), Dependabot (weekly version bumps), and the per-PR
# dependency-review gate. See docs/SUPPLY-CHAIN.md.
name: Supply-chain audit
on:
schedule:
- cron: "0 7 * * 1" # Mondays 07:00 UTC (an hour after Scorecard)
workflow_dispatch:
permissions:
contents: read
jobs:
audit:
name: weekly audit (npm advisories + invariants)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: "20"
cache: npm
- run: npm ci
# Zero runtime deps (ADR-0001) means published artifacts carry no advisory
# surface; this audits the DEV-tool surface. Advisory (never gates) because
# a dev-dep advisory does not ship to users — but it is surfaced weekly and
# written to the run summary so it can't sit unseen. Dependabot opens the
# actual bump PRs.
- name: npm audit (dev surface, advisory)
run: |
echo "## npm audit (dev dependencies)" >> "$GITHUB_STEP_SUMMARY"
echo '```' >> "$GITHUB_STEP_SUMMARY"
npm audit --audit-level=high 2>&1 | tee -a "$GITHUB_STEP_SUMMARY" || true
echo '```' >> "$GITHUB_STEP_SUMMARY"
# These DO gate: they are project invariants, not third-party advisories.
- name: Enforce zero runtime dependencies (ADR-0001)
run: node scripts/check-zero-deps.mjs
- name: Enforce SHA-pinned GitHub Actions
run: node scripts/check-action-pins.mjs
- name: Enforce the offline/agent boundary (ADR-0005)
run: node scripts/check-offline-boundary.mjs