SVGMaker MCP Server

name: Security & Dependencies on: schedule: # Run weekly on Mondays at 9 AM UTC - cron: '0 9 * * 1' push: branches: [ main ] pull_request: branches: [ main ] jobs: security-audit: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Use Node.js 20.x uses: actions/setup-node@v4 with: node-version: 20.x cache: 'npm' - name: Install dependencies run: npm ci - name: Run npm audit run: npm audit --audit-level moderate - name: Run npm audit fix if: failure() run: | npm audit fix --dry-run echo "⚠️ Security vulnerabilities found. Run 'npm audit fix' to resolve." dependency-check: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Check for outdated dependencies uses: actions/setup-node@v4 with: node-version: 20.x cache: 'npm' - name: Install dependencies run: npm ci - name: Check outdated packages run: | echo "📦 Checking for outdated packages..." npm outdated || true - name: Generate dependency report run: | echo "# Dependency Report" > dependency-report.md echo "Generated on: $(date)" >> dependency-report.md echo "" >> dependency-report.md echo "## Outdated Packages" >> dependency-report.md npm outdated --json > outdated.json || true if [ -s outdated.json ]; then echo "Found outdated packages. See outdated.json for details." >> dependency-report.md else echo "All packages are up to date! ✅" >> dependency-report.md fi - name: Upload dependency report uses: actions/upload-artifact@v4 with: name: dependency-report path: | dependency-report.md outdated.json retention-days: 30 license-check: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Use Node.js 20.x uses: actions/setup-node@v4 with: node-version: 20.x cache: 'npm' - name: Install dependencies run: npm ci - name: Install license checker run: npm install -g license-checker - name: Check licenses run: | echo "📄 Checking package licenses..." license-checker --summary license-checker --csv > licenses.csv - name: Upload license report uses: actions/upload-artifact@v4 with: name: license-report path: licenses.csv retention-days: 30