audit.yml

name: Dependency audit

# Full-tree `npm audit` for ambient advisories (vulnerabilities in deps no PR
# touched). This is intentionally NOT a per-PR gate: PRs are gated on the
# vulnerabilities they introduce via the dependency-review job in ci.yml, and
# Renovate (vulnerabilityAlerts) + GitHub Dependabot alerts open the fix PRs.
# This run keeps the whole tree under active audit on a cadence and on demand.

on:
  schedule:
    - cron: "0 16 * * 1" # Mondays 16:00 UTC (~9am America/Phoenix), aligns with Renovate
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: audit
  cancel-in-progress: true

jobs:
  audit:
    name: audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version-file: .nvmrc
          cache: npm
      - name: Install dependencies
        run: npm ci
      - name: Full dependency audit
        run: npm audit --audit-level=moderate