name: Dependency Audit

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: dependency-audit-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  audit:
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
          run_install: false

      - name: Use Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit high and critical dependency advisories
        run: pnpm audit:security