security.yml

name: Security

on:
  pull_request:
  schedule:
    # Run every Wednesday on 00:00
    - cron: "0 0 * * 3"

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  owasp_dependency_check:
    runs-on: ubuntu-latest
    name: OWASP Dependency Check
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: NPM install
        run: npm ci
      - name: Depcheck
        uses: dependency-check/Dependency-Check_Action@main
        id: Depcheck
        with:
          project: "test"
          path: "."
          format: "HTML"
          # https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html
          args: >
            --failOnCVSS 7
            --enableRetired
            --nodeAuditSkipDevDependencies
            --nodePackageSkipDevDependencies
      - name: Upload Test results
        uses: actions/upload-artifact@master
        with:
          name: Depcheck report
          path: ${{github.workspace}}/reports

  npm_audit:
    runs-on: ubuntu-latest
    name: NPM Audit
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: NPM install
        run: npm ci
      - name: Audit
        run: npm audit --omit=dev # or yarn audit --groups dependencies