feat: add npm audit checks to CI workflow

[jamesbhobbs]

Summary

Adds two new GitHub Actions jobs to the CI workflow for npm security auditing:

• Audit - Production: Runs npm audit --production to check production dependencies only
• Audit - All: Runs npm audit to check all dependencies

This follows the pattern established in deepnote/deepnote#36. The "Audit - Production" job will become a required status check via a separate terraform update.

Changes

• Added audit-prod job using npm audit --production
• Added audit-all job using npm audit
• Both jobs follow existing CI patterns (15min timeout, same Node.js setup)
• Dependencies installed with npm ci --prefer-offline --no-audit

Review Checklist

Critical items to verify:

• npm audit --production correctly filters to production dependencies only
• npm ci --prefer-offline --no-audit doesn't interfere with audit commands
• Job names match exactly what will be required in terraform config
• Timeout of 15 minutes is appropriate for audit operations

Context:

• Part of security audit rollout across multiple Deepnote repositories
• Production audit will become required status check after terraform update
• Pattern matches deepnote/deepnote implementation

---

Link to Devin run: https://app.devin.ai/sessions/1494020fb75d493c8b35d32b2f17aea9
Requested by: @jamesbhobbs

Summary by CodeRabbit

• Chores
  • Added automated dependency security audits to CI with separate jobs for production-only and full dependency sets.
  • Improves early detection of vulnerabilities and strengthens release reliability by running targeted and comprehensive audits during CI.
  • No changes to user-facing features or runtime behavior.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds two GitHub Actions CI jobs to .github/workflows/ci.yml: audit-prod and audit-all. Both checkout the repo, configure Node with a shared NODE_VERSION and npm cache, authenticate using the GitHub token and registry/scope settings, install dependencies via npm ci --prefer-offline --no-audit, then run npm audit --production (audit-prod) or npm audit (audit-all). No exported or public code entities were changed.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub
  participant Runner as Actions Runner
  participant Registry as npm Registry

  Dev->>GH: Push / Open PR
  GH->>Runner: Trigger CI workflow
  par audit-prod
    Runner->>Runner: actions/checkout
    Runner->>Runner: setup-node (NODE_VERSION, npm cache)
    Runner->>Registry: npm ci --prefer-offline --no-audit
    Runner->>Runner: npm audit --production
    alt vulnerabilities
      Runner-->>GH: Fail/report vulnerabilities
    else no vulnerabilities
      Runner-->>GH: Success
    end
  and audit-all
    Runner->>Runner: actions/checkout
    Runner->>Runner: setup-node (NODE_VERSION, npm cache)
    Runner->>Registry: npm ci --prefer-offline --no-audit
    Runner->>Runner: npm audit
    alt vulnerabilities
      Runner-->>GH: Fail/report vulnerabilities
    else no vulnerabilities
      Runner-->>GH: Success
    end
  end

Loading

Possibly related PRs

• ci: Add pnpm audit checks to CI workflow deepnote#36 — Adds audit-prod and audit-all to CI workflow (similar job names/structure) but uses pnpm instead of npm.
• chore: setup spell-check and root pnpm config deepnote#2 — Modifies the same .github/workflows/ci.yml to add CI jobs (different job: spell-check); related by CI workflow edits.

Suggested reviewers

• Artmann
• andyjakubowski
• saltenasl

Pre-merge checks

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title uses a conventional commit prefix and clearly states the addition of npm audit checks to the CI workflow, which is the primary change in this pull request. It is concise and omits unnecessary details while accurately reflecting the feature being introduced.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between b9efe4d and b8a2af8.

📒 Files selected for processing (1)

• .github/workflows/ci.yml (1 hunks)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8f22894 and b9efe4d.

📒 Files selected for processing (1)

• .github/workflows/ci.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Build & Test

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8f22894 and b9efe4d.

📒 Files selected for processing (1)

• .github/workflows/ci.yml (1 hunks)