{"repo":"IBM/audit-ci","free":true,"listed":false,"github":"https://github.com/IBM/audit-ci","clone":"git clone https://github.com/IBM/audit-ci.git","description":"Audit NPM, Yarn, PNPM, and Bun dependencies in continuous integration environments, preventing integration if vulnerabilities are found at or above a configurable threshold while ignoring allowlisted advisories","language":"TypeScript","stars":297,"topics":["audit","yarn","npm","audit-ci","security","ci","github-actions","pnpm","bun"],"license":"Apache-2.0","category":"security-tools","readme_excerpt":"audit-ci This module is intended to be consumed by your favourite continuous integration tool to halt execution if npm audit , yarn audit , or pnpm audit finds vulnerabilities at or above the specified threshold while ignoring allowlisted advisories. Note: Use our codemod to update to audit-ci v6.0.0 Requirements - Node =16 - (Optional) Yarn ^1.12.3 Yarn =2.4.0 && =4.3.0 - (Optional) Bun Limitations - Yarn Classic workspaces does not audit devDependencies . See this issue for more information. - Yarn v4 is not supported because it provides similar functionality to audit-ci . For more information, see the documentation on yarn npm audit . If you'd like audit-ci to support Yarn v4, voice your opinion on this issue. - Bun is supported by exporting the bun.lockb into a Yarn v1 yarn.lock file. Accordingly, auditing a bun.lockb file with audit-ci requires Yarn v1. Set up (Recommended) Install audit-ci during your CI environment using npx , yarn dlx , or pnpm dlx immediately after checking out the project's repository. Alternatively, audit-ci can be installed as a devDependency. The downside of this approach is that the CI may run a postinstall script of a compromised package before running audit-ci . The next section gives examples using audit-ci in various CI environments. It assumes moderate, high, and critical severity vulnerabilities prevent build continuation. Also, it suppresses an advisory of axios and a transitive advisory of react-scripts . Bun Bun supports exporting the b","default_branch":null,"files":null,"tree":[],"storefront":"/r/IBM","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/IBM/audit-ci/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}