Add dependency health status to the repository
- Dominant language
- TypeScript
- Stars
- 5
- Forks
- 0
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 6
Description
## As a KITT team member
## I want a visible, auto-updated indicator of dependency health in the KI Hub V2 repository
## So that outdated or vulnerable packages are immediately visible without inspecting `package.json` or chasing PRs
## Acceptance criteria
- [ ] A dependency health badge (Renovate status) is added to the repository `README.md`
- [ ] An `npm audit` step is added to the CI pipeline (`.github/workflows/deploy.yml`) that fails the build on any `high` or `critical` severity vulnerability
- [ ] If `npm audit` finds a critical vulnerability, the CI run is blocked and the failure reason is visible in the GitHub Actions log
- [ ] The audit step runs on every push to `main` and on every PR — not only on releases
- [ ] Zero known high/critical vulnerabilities are present when this story is closed (resolve any found during setup)
## Technical notes
Start with `npm audit --audit-level=high` in CI. If Digdir has an existing Snyk account, integrating Snyk is a valid alternative — check before adding a new tool. Do not add both.
## Dependencies
- #51 Configure automated dependency updates with Renovate
- #49 Configure GitHub Actions CI/CD pipeline for Azure deployment
## Estimate
1 day
## Parent epic
Part of Epic 1 — Foundation & Design System (#38)
Child of: #7 Dependency Dashboard
---
cc @Altinn/team-kitt
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.