audit-release.yml

name: Audit (release)
on:
  schedule:
    - cron: '0 3 * * *'
  workflow_dispatch: ~

permissions: read-all

jobs:
  v3:
    name: v3
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            ghcr.io:443
            github.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          ref: v3
      - name: Install Node.js
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Audit production npm dependencies
        run: npm run audit:runtime