Require a successful npm audit before tagging release (#137)

[skip ci]
oracc · Dec 14, 2022 · 1855d4d · 1855d4d
1 parent 675399d
commit 1855d4d
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
@@ -14,6 +14,10 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v3
+    - name: Audit
+      # Require a successful `npm audit` before tagging a release, to make sure
+      # we aren't tagging a version with known vulnerabilities.
+      run: npm audit
     - name: Find tag
       id: find_tag
       run: |