Skip to content

Conversation

@harsh-hak
Copy link

@harsh-hak harsh-hak commented Dec 16, 2025

Short description of the change:

Automated Vulnerability Scanning: I inserted the command npm audit --audit-level=high to run immediately after dependencies are installed. This scans your project's dependencies for known security vulnerabilities with a "high" severity rating.
Non-Blocking Execution: I added continue-on-error: true to this step. This ensures that if vulnerabilities are found, they are logged for your review, but they do not stop the rest of your custom security assessment script from running.

Copy link
Contributor

@elanlaw1206 elanlaw1206 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Harsh,

This looks good , adding npm audit --audit-level=high to the workflow is a sensible security visibility step, and keeping it non-blocking is fine at this stage.

One small ask: this PR currently includes some unrelated files/changes. Could you please split this so it only contains the workflow update to .github/workflows/security-assessment.yml? That will keep the change focused and easier to track.

Once scoped to the workflow-only change, this is good to go

Thanks!
King Hei

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants