Add security audit and dependency management workflows

[natansil]

Summary

This PR establishes automated security and dependency management practices by introducing GitHub Actions workflows and Dependabot configuration to keep dependencies secure and up-to-date.

Key Changes

• Security Audit Workflow (.github/workflows/security-audit.yml): Added automated npm audit checks that run on push to main, pull requests, and weekly schedule. The workflow enforces strict gating on high/critical vulnerabilities in production dependencies while providing informational reporting on all dependencies.

• Dependabot Configuration (.github/dependabot.yml): Configured automated dependency updates with:

  • Weekly npm package updates with a limit of 10 open PRs
  • Batched dev dependency updates (minor/patch versions) to reduce noise
  • Weekly GitHub Actions updates to keep CI/CD tooling current

• Dependency Updates (package.json): Updated production dependencies to latest secure versions:

  • axios: ^1.6.2 → ^1.17.0
  • socket.io-client: ^4.7.5 → ^4.8.3
  • uuid: ^13.0.0 → ^13.0.2

Notable Implementation Details

• The security audit workflow uses Node.js 20.x with npm caching for efficiency
• Production dependencies are gated at high/critical severity level to ensure only critical issues block builds
• All dependencies (including dev/transitive) are audited for visibility but don't block the build
• Dependabot is configured to respect the 10 PR limit to avoid overwhelming the review queue

https://claude.ai/code/session_016hVStNWDMqJLn4WMUAsNrM

[claude]

Claude finished @natansil's task —— View job

---

Pull Request Review

Review Checklist:

• Analyze security audit workflow
• Review Dependabot configuration
• Verify dependency updates
• Check for potential issues and best practices
• Provide comprehensive feedback

Overall Assessment

This PR introduces valuable security and dependency management practices. The implementation is generally solid with thoughtful design decisions. Here's my detailed feedback:

🟢 Strengths

Security Audit Workflow (.github/workflows/security-audit.yml)

1. Well-structured triggers: The workflow runs on push to main, PRs, weekly schedule (Mondays at 6 AM), and manual dispatch. The weekly schedule is particularly valuable for catching newly disclosed CVEs.

2. Smart severity gating: Production dependencies are gated at high/critical level only, which strikes a good balance between security and avoiding build breakage from lower-severity issues.

3. Comprehensive reporting: The two-stage audit (production-only with strict gating, then all dependencies for visibility) provides both enforcement and transparency.

4. Proper use of if: always(): Ensures the full audit report runs even if the production audit fails, maximizing visibility.

Dependabot Configuration (.github/dependabot.yml)

1. Batched dev dependencies: Grouping minor/patch updates for dev dependencies reduces PR noise while keeping production dependencies separate for individual review.

2. Reasonable PR limit: The 10 PR limit prevents overwhelming maintainers while allowing timely updates.

3. GitHub Actions updates: Including actions in the update schedule ensures CI/CD tooling stays current.

Dependency Updates

The updates to axios (1.6.2 → 1.17.0), socket.io-client (4.7.5 → 4.8.3), and uuid (13.0.0 → 13.0.2) address known security vulnerabilities while staying on compatible major versions.

🟡 Suggestions for Enhancement

1. Enhanced Audit Reporting

Consider adding a step to format the audit output for better visibility:

- name: Audit all dependencies (report only)
  if: always()
  run: |
    echo "## Full Dependency Audit Report" >> $GITHUB_STEP_SUMMARY
    npm audit --json | jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity) (\(.value.title))"' >> $GITHUB_STEP_SUMMARY || true
  continue-on-error: true

2. Cache npm audit database

Add caching for the npm audit database to improve performance:

- name: Cache npm audit
  uses: actions/cache@v3
  with:
    path: ~/.npm/_cacache
    key: ${{ runner.os }}-npm-audit-${{ github.run_id }}
    restore-keys: |
      ${{ runner.os }}-npm-audit-

3. Consider adding SARIF output

For better integration with GitHub Security tab:

- name: Run audit with SARIF output
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: '.'
    format: 'sarif'
    output: 'npm-audit-results.sarif'
    severity: 'HIGH,CRITICAL'
    
- name: Upload SARIF results
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: 'npm-audit-results.sarif'

4. Dependabot configuration enhancements

Consider adding:

• Explicit production dependency group for better organization
• Commit message prefix customization
• PR labels for easier filtering

groups:
  production-dependencies:
    dependency-type: "production"
    
commit-message:
  prefix: "deps"
  prefix-development: "deps-dev"
  
labels:
  - "dependencies"
  - "automated"

🔍 Minor Observations

1. Node.js version: Using Node.js 20.x is good, but consider using 20 instead of 20.x to always get the latest patch version.

2. Missing branch protection suggestion: Consider documenting that this workflow should be a required status check in branch protection rules for maximum effectiveness.

3. No timeout specified: Consider adding a timeout to the audit job to prevent hanging builds.

✅ Security & Best Practices

• No security issues identified in the implementation
• Follows GitHub Actions best practices with pinned action versions
• Appropriate use of continue-on-error for non-blocking reports
• Clear comments explaining the rationale behind design decisions

Summary

This is a well-implemented PR that adds important security infrastructure. The thoughtful balance between strict gating for production dependencies and comprehensive reporting for all dependencies shows good judgment. The suggested enhancements are optional improvements rather than critical issues.

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.31-pr.180.a2e145e

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.31-pr.180.a2e145e"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.31-pr.180.a2e145e"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.31-pr.180.a2e145e
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}