This lesson's interactive features are locked, please to keep using them

Dependency Maintenance

A security check only helps when it runs regularly and someone actually responds to its results. Developers often remember to keep security in mind in production, but forget about their CI servers!

Say we have this GitHub Actions workflow that runs on every push and pull request:

name: Dependency audit

on: [push, pull_request]

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: "24"
          cache: npm
      - run: npm ci --ignore-scripts
      - run: npm run audit:security

There are a few good practices here:

We pin actions/checkout and actions/setup-node to full-length commit SHAs, so a moved tag can't silently change the code our workflow runs.
We grant the GITHUB_TOKEN only contents: read permission, which is the minimum required for this workflow.
We use npm ci instead of npm install to install the exact dependency tree in package-lock.json.
We use --ignore-scripts when installing dependencies, which prevents any lifecycle scripts from running during installation, reducing the risk of executing potentially malicious code from dependencies.
We explicitly run npm run audit:security afterward, so --ignore-scripts doesn't prevent the audit itself from running.

Assignment

Bearly Secure's dependency audit currently depends on someone remembering to run it. Add a GitHub Actions workflow that enforces the audit policy on pushes and pull requests.

Create .github/workflows/dependency-audit.yml with push and pull_request triggers.
Grant GITHUB_TOKEN only contents: read permission.
Name the job audit and have it run on ubuntu-latest.
Pin actions/checkout and actions/setup-node to the full commit SHAs below, retaining their version comments. Do not use floating @v6 references.
```
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
```
Configure Node.js 24 with npm caching.
Run dependency installation and then the audit package script:
```
npm ci --ignore-scripts
npm run audit:security
```
Run the same install and audit commands locally. If actionlint is available, validate the workflow:
```
actionlint .github/workflows/dependency-audit.yml
```

Run and submit the CLI tests from the project root.