name: Dependency Check

# 依赖安全检查：生产依赖 moderate+ 或全局 critical 漏洞即失败；
# npm outdated 作为信息输出，不阻断。
# 注意：npmmirror 未实现 audit 接口，audit 必须显式指定官方 registry。

env:
  NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
  NPM_CONFIG_AUDIT: "false"
  NPM_CONFIG_FUND: "false"
  NPM_CONFIG_REPLACE_REGISTRY_HOST: always
  CI: "true"

on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '30 2 * * 1'   # 每周一 02:30 复查已发布的新漏洞
  workflow_dispatch:

jobs:
  check:
    runs-on: ubuntu-latest
    container: node:22.22.0-bookworm
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: https://gitee.com/mirrors_actions/checkout@v4
        with:
          github-server-url: https://git.gongxue100.com
          fetch-depth: 1

      - name: Install dependencies
        run: npm ci

      - name: Audit production dependencies (moderate+)
        run: npm audit --registry=https://registry.npmjs.org --omit=dev --audit-level=moderate

      - name: Audit all dependencies (critical only)
        run: npm audit --registry=https://registry.npmjs.org --audit-level=critical

      - name: Outdated report (informational)
        run: npm outdated --registry=https://registry.npmjs.org || true