This action audits the package.json of a project and makes a comment on the associated PR to highlight any nasty dependency issues that may have arisen recently. It is intended to provide visibility on the open audit issues rather than mandate an update/fix, leaving enforcing these issues to the PR approver/raiser. It runs on a pull request trigger and executes npm audit on the specified package.json.

Required Folder within which the package.json lives (relative to project root). Default "./".

Required GitHub access token, needed to make a comment on the PR.

In .github/workflows/npm-audit.yml paste the following snippet.

name: "NPM Audit Report - PR"

on:
  pull_request:

jobs:
  worker:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v1

      - name: NPM Audit Comment
        uses: wx-jayesh/actions-npm-audit-comment@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}