ci: make the dependency audit its own advisory job #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Type-checks and builds every pull request, and reports on the dependencies | |
| # that reach consumers. | |
| # | |
| # build-lib alone is not enough to catch type errors: @rollup/plugin-typescript | |
| # reports them as warnings and still emits a bundle, so a broken type check can | |
| # sit unnoticed behind a green build. tsc --noEmit is what actually fails. | |
| name: Check | |
| on: | |
| pull_request: | |
| branches: | |
| - develop | |
| - main | |
| push: | |
| branches: | |
| - develop | |
| jobs: | |
| check: | |
| name: Type check and build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - run: npm ci | |
| - name: Type check | |
| run: npx tsc --noEmit -p tsconfig.json | |
| - name: Build library | |
| run: npm run build-lib | |
| audit: | |
| name: Audit dependencies reaching consumers | |
| runs-on: ubuntu-latest | |
| # Advisory, not a gate. This queries the npm registry at run time, so an | |
| # advisory disclosed today would otherwise turn every open pull request | |
| # red, including ones that touch no dependency at all. The result is | |
| # written to the job summary; read it there rather than relying on the | |
| # check colour. | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| # npm audit resolves the tree from package-lock.json, so there is no | |
| # need to install anything first. | |
| - name: Audit | |
| run: | | |
| set +e | |
| report="$(npm audit --omit=dev --audit-level=high 2>&1)" | |
| code=$? | |
| { | |
| echo '## Dependencies reaching consumers' | |
| echo | |
| echo 'Scope: `npm audit --omit=dev --audit-level=high` — what a consumer' | |
| echo 'of this package installs, ignoring the dev toolchain.' | |
| echo | |
| if [ $code -eq 0 ]; then | |
| echo 'No high or critical advisories.' | |
| else | |
| echo 'Found something worth a look:' | |
| echo | |
| echo '```' | |
| echo "$report" | |
| echo '```' | |
| fi | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| echo "$report" | |
| exit $code |