Repository navigation

feat(cli): show doctor checks as they run #18

	name: Security
	on:
	push:
	pull_request:
	# New advisories appear without code changes.
	schedule:
	- cron: '0 6 * * 1'

	permissions:
	contents: read

	jobs:
	# Unpinned actions, broad permissions, template injection and risky triggers.
	zizmor:
	if: github.event_name != 'pull_request'
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
	with:
	advanced-security: false

	# Accepted advisories are listed, with the reason, in packages/cli/src/commands/audit-deps.ts.
	audit-deps:
	if: github.event_name != 'pull_request'
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
	with:
	node-version-file: package.json
	- run: npm ci
	- run: ./hb audit-deps

	# New dependencies with high or critical advisories.
	dependency-review:
	if: github.event_name == 'pull_request'
	runs-on: ubuntu-latest
	steps:
	- uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
	with:
	fail-on-severity: high