Improve npm audit workflow
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 24
- Forks
- 11
- Avg merge
- 13h 22m
- Merged PRs (30d)
- 15
Description
The workflow is quite good and helpful.
However currently the developers need to check locally if everything is still working fine. In quite many cases the fixed dependencies are however development related and don't change the production files.
It would therefore be support helpful if the workflow could:
- Compile the app and copy js/ to js-backup/
- NPM audit
- Compile the app again
- Diff js/ and js-backup/
If the diff is empty: extend the PR description with:
[!TIP]
Assets did not change
If the diff is not empty:
[!WARNING]
Assets changed
This allows developers to speed up the merge time and skip local testing when nothing changed in the assets
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the existing npm audit workflow and trace how it currently compiles the app and updates the pull request description. Verify the two builds, js/ backup, audit step, and asset diff, then confirm the description receives the appropriate TIP or WARNING message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, node.js
- Domain
- build-system, ci-cd
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100