dependency-security.yml

name: Dependency Security

# Runs on every PR and every push to main.
# Hard-blocks on Critical npm vulnerabilities.
# Warns on High npm vulnerabilities (non-blocking — devDep false positives are common).
# Tauri/cargo audit is not run — desktop releases are retired.

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  # ── npm audit ──────────────────────────────────────────────────────────────
  npm-audit:
    name: npm audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22
          # No cache: npm — package-lock.json is gitignored in this project.

      # Generate lockfile on the fly so npm audit has a full dependency graph.
      # Consider committing package-lock.json for faster, deterministic CI.
      - name: Generate lockfile
        run: npm install --package-lock-only --ignore-scripts

      # Hard block — Critical vulns in production dependencies.
      - name: Fail on Critical vulnerabilities
        run: npm audit --audit-level=critical --omit=dev

      # Soft check — High vulns across all deps (informational; common in devDeps).
      - name: Warn on High vulnerabilities
        run: npm audit --audit-level=high || echo "⚠️  High-severity advisories found — review npm-audit-full.json"

      # Upload full JSON report as a build artifact for manual review.
      - name: Save full audit report
        if: always()
        run: npm audit --json > npm-audit-full.json || true

      - name: Upload audit report
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: npm-audit-report
          path: npm-audit-full.json
          retention-days: 30

  # ── ESLint security rules ──────────────────────────────────────────────────
  eslint-security:
    name: ESLint security
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: 22

      - name: Install dependencies
        run: npm install --ignore-scripts

      # Errors (inject/eval/ReDoS) cause non-zero exit and block the PR.
      # Warnings (detect-non-literal-fs-filename) are informational — legitimate
      # server/CLI filesystem operations use variable paths by design.
      - name: Run ESLint security rules
        run: npx eslint .