audit.yml

name: Audit
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
jobs:
  node_matrix_audit:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [22, 24]
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install Monorepo Deps
        run: npm ci --ignore-scripts
      - name: Run After Install Script
        run: npm run afterinstall

      - name: Run npm audit
        run: |
          npm audit --json | node -e '
            const fs = require("fs");
            const auditLevel = (process.argv[2] || "critical").toLowerCase();
            const raw = fs.readFileSync(0).toString("utf-8");
            let vulnerabilities = {};
            try {
              const parsed = JSON.parse(raw || "{}");
              vulnerabilities = parsed.vulnerabilities || {};
            } catch (e) {
              console.error("Failed to parse npm audit output:", e.message || e);
              process.exit(2);
            }
            const result = Object.values(vulnerabilities).filter((i) => i && i.severity && i.severity.toLowerCase() === auditLevel);
            if (result.length) {
              console.log(JSON.stringify(result, null, 2));
              process.exit(1);
            } else {
              console.log('[]');
            }
          ' high

  npm_audit:
    runs-on: ubuntu-latest
    needs: node_matrix_audit
    if: success()
    steps:
      - name: Final status
        run: echo "✅ npm audit passed for Node.js 20, 22 and 24"