name: Audit

on:
  push:
    # Skip the redundant run on the merge queue's temporary
    # `gh-readonly-queue/**` branches; the pull_request run already covered it.
    branches-ignore:
      - 'gh-readonly-queue/**'
  pull_request:

permissions:
  contents: read # to fetch code (actions/checkout)

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  audit:
    name: Audit dependencies
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
    - name: Checkout Commit
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: Install pnpm
      uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
      with:
        install: false
    - name: Audit
      run: pn audit