package-audit.yml

name: Package Audit

on:
  push:
    branches:
    paths:
      - package.json
      - package-lock.json
      - .github/workflows/package-audit.yml
  workflow_dispatch:

permissions:
  contents: read

jobs:
  audit-npm:
    name: NPM Audit
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
        with:
          allowed-endpoints: 
            api.github.com:443
            github.com:443
            registry.npmjs.org:443

      - name: Audit with NPM
        uses: myrotvorets/composite-actions/node-package-audit@6aa2c0d9b6471fea741d4b28b356682abd90447e