Skip to content

Commit daeba6e

Browse files
authored
Add npm audit to the build steps action for CDA (#1256)
Ran this locally to test, currently with the dependabot changes merged #1243 Reporting ``` npm audit --audit-level=high found 0 vulnerabilities ``` Note: I went with node 20 in the actions, but we could probably bump that up?
1 parent 71fec43 commit daeba6e

1 file changed

Lines changed: 12 additions & 0 deletions

File tree

.github/workflows/build.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,18 @@ jobs:
3030
distribution: 'temurin'
3131
java-version: ${{matrix.jdk}}
3232
cache: 'gradle'
33+
- name: install node for cda-gui audit
34+
uses: actions/setup-node@v4
35+
with:
36+
node-version: '22'
37+
cache: 'npm'
38+
cache-dependency-path: cda-gui/package-lock.json
39+
40+
- name: run cda-gui audit for high CVE
41+
working-directory: ./cda-gui
42+
run: |
43+
npm install --package-lock-only
44+
npm audit --audit-level=high
3345
- name: build and test
3446
id: thebuild
3547
run: ./gradlew build --info --init-script init.gradle

0 commit comments

Comments
 (0)