Merge pull request #340 from appwrite/fix-audit-no-lock-regen

fix: audit the committed lockfile without regenerating it

Author: ChiragAgg5k

.github/workflows/publish.yml

@@ -143,12 +143,7 @@ jobs:
           fi
 
       - name: Audit npm dependencies
-        run: |
-          # CLI builds with Bun, but npm audit reads package-lock.json.
-          # update-lockfiles.sh updates both lockfiles; this catches npm lock drift.
-          npm install --package-lock-only --ignore-scripts
-          git diff --exit-code package-lock.json
-          npm audit --audit-level=high --omit=dev
+        run: npm audit --package-lock-only --audit-level=high --omit=dev
 
       - name: Publish
         run: npm publish --provenance --access public --tag ${{ steps.release_tag.outputs.tag }}