From 75654b9b79542729c11ebb392d585336114cf153 Mon Sep 17 00:00:00 2001 From: Shyngys Shynbolatov Date: Thu, 15 Oct 2026 18:30:40 +0600 Subject: [PATCH 1/2] ci: add npmscan-action for dependency security --- .github/workflows/npmscan.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .github/workflows/npmscan.yml diff --git a/.github/workflows/npmscan.yml b/.github/workflows/npmscan.yml new file mode 100644 index 00000000000..4826dbf0497 --- /dev/null +++ b/.github/workflows/npmscan.yml @@ -0,0 +1,17 @@ +name: NPMscan + +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + npmscan: + name: Dependency Security Scan + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Run NPMscan + uses: NPMscan/npmscan-action@de14168f65640a4ed1f0e82ad3ad8c80483d360d + with: + mode: warn + fail-on-error: false From 3bd8614fd88d1781560c9d0a778f886d74646c13 Mon Sep 17 00:00:00 2001 From: Shyngys Shynbolatov Date: Mon, 9 Nov 2026 19:20:49 +0800 Subject: [PATCH 2/2] ci: bump npmscan-action to v1.4.1 v1.4.1 reads dependency files from git and never follows symlinks. Earlier versions copied the PR's lockfile with cp, so a PR could replace it with a symlink to another file on the runner and have that file uploaded. Release notes: https://github.com/NPMscan/npmscan-action/releases/tag/v1.4.1 --- .github/workflows/npmscan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/npmscan.yml b/.github/workflows/npmscan.yml index 4826dbf0497..a7d950686e8 100644 --- a/.github/workflows/npmscan.yml +++ b/.github/workflows/npmscan.yml @@ -11,7 +11,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: Run NPMscan - uses: NPMscan/npmscan-action@de14168f65640a4ed1f0e82ad3ad8c80483d360d + uses: NPMscan/npmscan-action@e2ff8c953f1a0b536abd70b4479984137c76e1fe # v1.4.1 with: mode: warn fail-on-error: false