feat: Vercel Marketplace images — 5 gallery + 3 icon sizes #920
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependency audit — runs npm audit and fails on high/critical advisories. | |
| # Moderate/low findings are reported as an artifact for triage but do NOT fail | |
| # the job, because some moderate vulns are transitive deps of Next.js whose only | |
| # "fix" is a breaking downgrade (e.g. postcss via next). Gating on high/critical | |
| # keeps CI green on unactionable moderate findings while still blocking real risk. | |
| name: Dependency Audit | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Twice weekly — catches newly disclosed advisories between PRs. | |
| - cron: "17 6 * * 1,4" | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| name: npm audit (high/critical gate) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: npm audit (fail on high/critical) | |
| # --omit=dev: production deps only (the ones that ship to Vercel). | |
| # --audit-level=high: exit non-zero only on high or critical. | |
| run: npm audit --omit=dev --audit-level=high | |
| - name: Full audit report (always, for triage) | |
| if: always() | |
| run: | | |
| echo "## npm audit — full report" > audit-report.md | |
| echo "" >> audit-report.md | |
| echo '```' >> audit-report.md | |
| npm audit --omit=dev || true >> audit-report.md 2>&1 | |
| echo '```' >> audit-report.md | |
| - name: Upload audit report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: npm-audit-report | |
| path: audit-report.md | |
| retention-days: 14 |