pnpm/.github/workflows/audit.yml

name: Audit

on:
  push:
    # Skip the redundant run on the merge queue's temporary
    # `gh-readonly-queue/**` branches; the pull_request run already covered it.
    branches-ignore:
      - 'gh-readonly-queue/**'
  pull_request:

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  audit:
    name: Audit dependencies
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
    - name: Checkout Commit
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
    - name: Install pnpm
      uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
      with:
        install: false
    - name: Audit
      run: pn audit