ci: add npmscan PR dependency scan

SA
6d ago
+24-0

Summary

  • add a dedicated npmscan workflow for pull requests that touch workspace package.json files, pnpm-lock.yaml, or pnpm-workspace.yaml
  • start in mode: warn so the team can review the signal without changing merge behavior
  • pin the action to the current v1.3.0 commit and keep fail-on-error: false so scanner availability does not block merges

Why

This adds PR-time dependency diff review with extra supply-chain checks around new install scripts, lockfile source changes, changed overrides/resolutions, and malware advisories that do not usually appear in standard vulnerability audits.

Test plan

  • Open a PR that changes pnpm-lock.yaml or a workspace package.json
  • Confirm the npmscan workflow runs
  • Confirm findings are reported in warn mode without failing the PR
  • Confirm unrelated PRs do not trigger the workflow

Summary by cubic

Adds an npmscan workflow that runs on pull requests touching package.json, pnpm-lock.yaml, or pnpm-workspace.yaml, adding supply-chain checks for new install scripts, lockfile source changes, changed overrides/resolutions, and malware advisories that standard vulnerability audits miss.

Runs in warn mode with fail-on-error: false so findings are reported without blocking merges; the action is pinned to v1.3.0. Unrelated PRs do not trigger the workflow.

Summary by CodeRabbit

  • New Features
    • Pull requests that update package manifests or workspace and lockfile configuration are now automatically checked for known package vulnerabilities.
    • Scan results are reported as warnings, and scan errors do not prevent the pull request workflow from completing.