- run a proper npm audit rather than just a dependency review to highlight issues in existing packages as wall, not just changed/updated

- pin actions

Author: CarrJ

.github/workflows/npm-vulnerability-scanner.yaml

@@ -1,4 +1,5 @@
-name: NPM vulnerability scanner
+name: NPM Audit Security Check
+
 on:
   workflow_call:
   workflow_dispatch:
@@ -10,14 +11,45 @@ jobs:
   npm-audit:
     runs-on: ubuntu-latest
     steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 #5.0.0
+      - name: Checkout Code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          # If it's a PR, use the target branch. If it's a push, use 'main'.
-          base-ref: ${{ github.event.pull_request.base.ref || 'main' }}
-          # If it's a PR, use the source branch. If it's a push, use the current commit.
-          head-ref: ${{ github.event.pull_request.head.ref || github.sha }}
-          fail-on-severity: high
-          show-patched-versions: true
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Run NPM Audit & Generate Summary
+        run: |
+          # 1. Run npm audit in JSON mode to capture raw audit metadata
+          AUDIT_JSON=$(npm audit --audit-level=high --json 2>/dev/null) || true
+
+          # 2. Extract counts using node's built-in JSON parser
+          CRITICAL_COUNT=$(echo "$AUDIT_JSON" | node -e "let d=''; process.stdin.on('data', c => d += c); process.stdin.on('end', () => { try { console.log(JSON.parse(d).metadata.vulnerabilities.critical || 0) } catch { console.log(0) } })")
+          HIGH_COUNT=$(echo "$AUDIT_JSON" | node -e "let d=''; process.stdin.on('data', c => d += c); process.stdin.on('end', () => { try { console.log(JSON.parse(d).metadata.vulnerabilities.high || 0) } catch { console.log(0) } })")
+          
+          # 3. Build GitHub Job Summary Markdown
+          echo "## 🛡️ NPM Dependency Audit Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ "$CRITICAL_COUNT" -eq 0 ] && [ "$HIGH_COUNT" -eq 0 ]; then
+            echo "✅ **No high or critical vulnerabilities found!** All JS packages passed security checks." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "⚠️ **High/Critical Vulnerabilities Detected in npm Dependencies**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Vulnerability Severity | Total Count |" >> $GITHUB_STEP_SUMMARY
+            echo "| :--- | :--- |" >> $GITHUB_STEP_SUMMARY
+            echo "| 🔴 **Critical** | $CRITICAL_COUNT \vert{}" >> $GITHUB_STEP_SUMMARY
+            echo "| 🟠 **High** | $HIGH_COUNT \vert{}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Detailed Audit Report" >> $GITHUB_STEP_SUMMARY
+            echo '```text' >> $GITHUB_STEP_SUMMARY
+            # Output human-readable audit text into the summary block
+            npm audit --audit-level=high 2>/dev/null || true
+            echo '```' >> $GITHUB_STEP_SUMMARY
+
+            # 4. Fail the workflow step
+            echo "::error::npm audit detected $CRITICAL_COUNT critical and $HIGH_COUNT high vulnerabilities."
+            exit 1
+          fi

.github/workflows/ruby-vulnerability-scanner.yaml

@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b
         with:
           ruby-version: '3.3'
           bundler-cache: true