Altinn / Altinn/kihub

Add dependency health status to the repository

Open
#52 0 comments 0 reactions 1 assignee Claimed by @adidahl View on GitHub
area/tools priority/medium type/task
Dominant language
TypeScript
Stars
5
Forks
0
Avg merge
1d 23h
Merged PRs (30d)
6

Description

## As a KITT team member
## I want a visible, auto-updated indicator of dependency health in the KI Hub V2 repository
## So that outdated or vulnerable packages are immediately visible without inspecting `package.json` or chasing PRs

## Acceptance criteria
- [ ] A dependency health badge (Renovate status) is added to the repository `README.md`
- [ ] An `npm audit` step is added to the CI pipeline (`.github/workflows/deploy.yml`) that fails the build on any `high` or `critical` severity vulnerability
- [ ] If `npm audit` finds a critical vulnerability, the CI run is blocked and the failure reason is visible in the GitHub Actions log
- [ ] The audit step runs on every push to `main` and on every PR — not only on releases
- [ ] Zero known high/critical vulnerabilities are present when this story is closed (resolve any found during setup)

## Technical notes
Start with `npm audit --audit-level=high` in CI. If Digdir has an existing Snyk account, integrating Snyk is a valid alternative — check before adding a new tool. Do not add both.

## Dependencies
- #51 Configure automated dependency updates with Renovate
- #49 Configure GitHub Actions CI/CD pipeline for Azure deployment

## Estimate
1 day

## Parent epic
Part of Epic 1 — Foundation & Design System (#38)
Child of: #7 Dependency Dashboard

---
cc @Altinn/team-kitt

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.