joplin-mcp-server

name: Security Audit

# Note: CodeQL analysis is handled by GitHub's default setup
# This workflow focuses on dependency auditing only

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    # Run weekly on Sunday at 2 AM UTC
    - cron: "0 2 * * 0"

jobs:
  audit:
    name: Dependency Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install pnpm
        uses: pnpm/action-setup@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22.x"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run pnpm audit
        run: pnpm audit --audit-level moderate
        continue-on-error: true

      - name: Run npm audit (fallback)
        run: npm audit --audit-level moderate
        continue-on-error: true

  # CodeQL analysis is handled by GitHub's default setup
  # Custom CodeQL job removed to avoid conflicts