# Runs npm audit on pull requests — no GitHub Advanced Security / dependency-review required.
name: PR npm audit

on:
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: package-lock.json
      - name: Root — npm ci + audit
        run: |
          npm ci
          npm audit --audit-level=critical
      - name: Documentation — npm ci + audit
        working-directory: documentation
        run: |
          npm ci
          npm audit --audit-level=critical
