package-audit.yml

name: Package Audit

on:
  push:
    branches:
      - '**'
    paths:
      - package.json
      - package-lock.json
      - .github/workflows/package-audit.yml
  workflow_dispatch:

permissions:
  contents: read

jobs:
  audit-npm:
    name: NPM Audit
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
        with:
          disable-sudo: true
          allowed-endpoints:
            api.github.com:443
            github.com:443
            registry.npmjs.org:443

      - name: Audit with NPM
        uses: myrotvorets/composite-actions/node-package-audit@master