search

yetanalytics / lrs

Protocols, specifications, and logic for building an xAPI Learning Record Store (LRS) in Clojure(Script).
https://www.yetanalytics.com/lrs
Apache License 2.0
4 stars 1 forks source link

Audit npm in CI #60

Closed milt closed 3 years ago

milt commented 3 years ago

Dependabot is nice but we only get alerts when code hits master. Add npm audit to the CI workflow so it fails if any sec issues are detected!

kelvinqian00 commented 3 years ago

I'm curious how this works - if there are security vulnerabilities, how exactly will npm audit cause CI to fail? Nonzero exit code?

milt commented 3 years ago

Yep. It's zero if everything's OK, but if there is any vulnerability it should fail

milt commented 3 years ago

I'd prefer a flag on npm install that makes it fail if there are any vulnerabilities, since it runs npm audit anyways, but for some reason that doesn't seem to be a thing?