feat: support auditLevel (#10554)

* feat: support `auditLevel`

* refactor: auditLevel

---------

Co-authored-by: Zoltan Kochan <z@kochan.io>

.changeset/lucky-bikes-nail.md

@@ -0,0 +1,7 @@
+---
+"@pnpm/plugin-commands-audit": minor
+"@pnpm/config": minor
+"pnpm": minor
+---
+
+Support configuring `auditLevel` in the `pnpm-workspace.yaml` file [#10540](https://github.com/pnpm/pnpm/issues/10540).

config/config/src/Config.ts

@@ -238,6 +238,7 @@ export interface Config extends AuthInfo, OptionsFromRootManifest {
   trustPolicy?: TrustPolicy
   trustPolicyExclude?: string[]
   trustPolicyIgnoreAfter?: number
+  auditLevel?: 'low' | 'moderate' | 'high' | 'critical'
 
   packageConfigs?: ProjectConfigSet
 }

config/config/src/configFileKey.ts

@@ -153,6 +153,7 @@ export const excludedPnpmKeys = [
   'cpu',
   'libc',
   'os',
+  'audit-level',
 ] as const satisfies ReadonlyArray<Exclude<PnpmKey, PnpmConfigFileKey>>
 export type ExcludedPnpmKey = typeof excludedPnpmKeys[number]
 

config/config/src/types.ts

@@ -139,6 +139,7 @@ export const pnpmTypes = {
   cpu: [String, Array],
   libc: [String, Array],
   os: [String, Array],
+  'audit-level': ['low', 'moderate', 'high', 'critical'],
 }
 
 // NOTE: There is an oversight I just now notice thanks to a test failure: pnpmTypes (which used to be the object literal inside `Object.assign`)

lockfile/plugin-commands-audit/src/audit.ts

@@ -123,7 +123,6 @@ export function help (): string {
 }
 
 export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
-  auditLevel?: 'low' | 'moderate' | 'high' | 'critical'
   fix?: boolean
   ignoreRegistryErrors?: boolean
   json?: boolean
@@ -132,6 +131,7 @@ export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
   ignore?: string[]
   ignoreUnfixable?: boolean
 } & Pick<Config, 'auditConfig'
+| 'auditLevel'
 | 'ca'
 | 'cert'
 | 'httpProxy'