From 9e875134ade26b1dcc3ef908e05db29179780303 Mon Sep 17 00:00:00 2001 From: Shyngys Shynbolatov Date: Tue, 13 Oct 2026 02:09:28 +0600 Subject: [PATCH 1/2] ci: add npmscan pull request scan --- .github/workflows/npmscan.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/workflows/npmscan.yml diff --git a/.github/workflows/npmscan.yml b/.github/workflows/npmscan.yml new file mode 100644 index 0000000000..ae016442c0 --- /dev/null +++ b/.github/workflows/npmscan.yml @@ -0,0 +1,24 @@ +name: npmscan + +on: + pull_request: + paths: + - package.json + - '**/package.json' + - pnpm-lock.yaml + - pnpm-workspace.yaml + +permissions: + contents: read + pull-requests: write + +jobs: + scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: NPMscan/npmscan-action@de14168f65640a4ed1f0e82ad3ad8c80483d360d # v1.3.0 + with: + file: pnpm-lock.yaml + mode: warn + fail-on-error: false From e7f3130ab27703f1a277c59c15ebdff97eb92841 Mon Sep 17 00:00:00 2001 From: Shyngys Shynbolatov Date: Mon, 9 Nov 2026 19:08:29 +0800 Subject: [PATCH 2/2] ci: bump npmscan-action to v1.4.1 v1.4.1 reads dependency files from git and never follows symlinks. Earlier versions copied the PR's lockfile with cp, so a PR could replace it with a symlink to another file on the runner and have that file uploaded. Release notes: https://github.com/NPMscan/npmscan-action/releases/tag/v1.4.1 --- .github/workflows/npmscan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/npmscan.yml b/.github/workflows/npmscan.yml index ae016442c0..5416d9db6c 100644 --- a/.github/workflows/npmscan.yml +++ b/.github/workflows/npmscan.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - - uses: NPMscan/npmscan-action@de14168f65640a4ed1f0e82ad3ad8c80483d360d # v1.3.0 + - uses: NPMscan/npmscan-action@e2ff8c953f1a0b536abd70b4479984137c76e1fe # v1.4.1 with: file: pnpm-lock.yaml mode: warn