Run npm audit only on prod dependencies

GoogleCloudPlatform / cloud-run-anthos-reference-web-app

An opinionated set of best practices aimed at demonstrating a reference architecture for building a web application on Google Cloud using Cloud Run for Anthos.

https://cloud.google.com/anthos/run

Apache License 2.0

37 stars 22 forks source link

Run npm audit only on prod dependencies #56

Closed josueetcom closed 4 years ago

josueetcom commented 4 years ago

npm audit checks started failing today due to a security vulnerability newly published. This only affects our dev dependencies and shouldn't block other PRs from submitting.

josueetcom commented 4 years ago

Alternatively or additionally, we could separate the checks based on paths using on.pull_request.paths.