chore(deps): bump the production group across 1 directory with 12 updates #210
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSV-Scanner | |
| # Scans package-lock.json against the OSV vulnerability database. Runs on every | |
| # PR, on pushes to main that touch the lockfile, and on a weekly schedule. | |
| # | |
| # Detection-only: it does NOT open PRs or change pins. It reports known CVEs in | |
| # currently-pinned versions so we can patch on our own schedule. fail-on-vuln is | |
| # disabled so pre-existing vulns in pinned deps don't block merges. Findings land | |
| # in the Security tab (Code scanning > OSV-Scanner). Dependabot handles updates. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| paths: | |
| - "package.json" | |
| - "package-lock.json" | |
| schedule: | |
| - cron: "0 9 * * 1" # Monday 09:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| scan: | |
| name: Scan lockfile | |
| # Google's officially-recommended reusable workflow, pinned by SHA. | |
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 | |
| with: | |
| scan-args: |- | |
| --lockfile=package-lock.json | |
| fail-on-vuln: false |