Skip to content

Add npmscan pull request workflow - #12340

Open
salemalem wants to merge 1 commit into
chartjs:masterfrom
salemalem:ci/add-npmscan-warn-mode
Open

salemalem wants to merge 1 commit into
chartjs:masterfrom
salemalem:ci/add-npmscan-warn-mode

Conversation

@salemalem

Copy link
Copy Markdown

Summary

  • add a pull request workflow that runs NPMscan/npmscan-action for pnpm-lock.yaml changes
  • keep the workflow narrow around the root manifest and lockfiles
  • keep the check low-friction with mode: warn and fail-on-error: false

Why

This adds a lightweight supply-chain check for PRs so new install scripts, tarball swaps, and lockfile overrides get surfaced during review without blocking contributors.

Test plan

  • workflow file added under .github/workflows/npmscan.yml
  • action pinned to de14168f65640a4ed1f0e82ad3ad8c80483d360d
  • workflow scoped to relevant manifest and lockfile changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant