Merge pull request #1067 from shogun444/refactor/964-secure-storage-i… #824

	name: Dependency Audit

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '0 6 * * 1' # Every Monday at 06:00 UTC

	# Restrict default GITHUB_TOKEN permissions (fix for issue #924)
	permissions:
	contents: read

	jobs:
	audit:
	name: npm audit + depcheck + license
	runs-on: ubuntu-latest
	permissions:
	contents: read

	env:
	EXPO_PUBLIC_API_BASE_URL: https://api.teachlink.com
	EXPO_PUBLIC_SOCKET_URL: wss://api.teachlink.com
	EXPO_PUBLIC_APP_ENV: production
	EXPO_PUBLIC_ENABLE_PUSH_NOTIFICATIONS: true

	steps:
	- uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '20'
	cache: 'npm'

	# Use npm ci so the audited tree matches the lockfile exactly (fix for issue #925)
	- name: Install dependencies
	run: npm ci

	- name: Check for high/critical vulnerabilities
	run: npm run audit

	- name: Check for unused dependencies
	run: npm run depcheck

	- name: Check for disallowed dependency licenses
	run: npm run license:check

Navigation Menu