Research MCP

name: Security & Dependencies on: schedule: # Run every Monday at 9:00 AM UTC - cron: '0 9 * * 1' workflow_dispatch: # Allow manual trigger push: branches: [main] paths: - 'package.json' - 'package-lock.json' jobs: audit: name: Security Audit runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20.x' cache: 'npm' - name: Install dependencies run: npm ci - name: Run npm audit run: npm audit --audit-level=moderate continue-on-error: true - name: Run npm audit (production only) run: npm audit --production --audit-level=high dependency-check: name: Dependency Check runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20.x' cache: 'npm' - name: Install dependencies run: npm ci - name: List installed packages run: npm list --depth=0 - name: Check for outdated dependencies run: | npm outdated || true echo "ℹ️ Check output above for outdated dependencies"