# Runs npm audit on pull requests — no GitHub Advanced Security / dependency-review required.
name: PR npm audit

on:
  pull_request:
    branches: [main]
    paths:
      - "package.json"
      - "package-lock.json"
      - "documentation/package.json"
      - "documentation/package-lock.json"
      - ".github/workflows/pr-npm-audit.yml"

permissions:
  contents: read

jobs:
  audit:
    runs-on: [self-hosted, Linux, X64]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: package-lock.json
      - name: Root — npm ci + audit
        run: |
          npm ci
          npm audit --audit-level=critical
      - name: Documentation — npm ci + audit
        working-directory: documentation
        run: |
          npm ci
          npm audit --audit-level=critical
