name: Dependency audit

# Dependabot cannot parse the pub-*.r2.dev tarball specifiers used for
# prime-agent, so a scheduled npm audit is the advisory coverage for the
# production dependency tree (see docs/security.md, "Dependency pinning and
# supply chain").
on:
  schedule:
    - cron: '17 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm run toolchain:bootstrap
      - run: npm run release:preflight:toolchain
      - name: Audit production dependencies for high and critical advisories
        run: npm run audit:production