chore(CI-CD): 🔧 enforce strict dependency security audit in CI

[baxyz]

Summary

• add a reusable strict security audit job to GitHub Actions
• make the security audit blocking in both PR validation and release workflows
• configure the audit in strict mode with pnpm audit --audit-level low
• remove angular-oauth2-oidc, which was only used for a type import but introduced vulnerable runtime dependencies
• replace the external OAuth error type with a local structural type in errorToReadableMessage
• update build externals and lockfile accordingly

Why

The repository already had a security workflow, but it was non-blocking because it used pnpm audit || true.

This change turns security auditing into a real gate in CI and fixes the current vulnerability baseline so the strict audit can pass cleanly.

Validation

• pnpm audit --audit-level low
• pnpm typecheck
• pnpm test
• pnpm build

Notes

• the removed angular-oauth2-oidc dependency was not needed at runtime
• using a local structural type preserves the same behavior while avoiding the vulnerable dependency tree
• the PR validation report now includes a dedicated 🔐 Security Audit status

[Copilot]

Pull request overview

This PR makes dependency vulnerability scanning a blocking gate in CI by introducing a reusable strict pnpm audit job and wiring it into both PR validation and release workflows. It also removes an unused dependency (angular-oauth2-oidc) and replaces its imported OAuth error type with a local structural type to avoid shipping a vulnerable dependency tree to consumers.

Changes:

• Add a reusable GitHub Actions security audit job and enforce pnpm audit --audit-level low as a required check.
• Make the security audit job blocking in PR validation and release workflows, and surface its status in the PR report.
• Remove angular-oauth2-oidc from dependencies/externals and replace the type import with a local OAuthErrorEventLike interface.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/build/helpers/compile-type-script.helper.ts	Removes angular-oauth2-oidc from declaration/build externals.
package.json	Drops angular-oauth2-oidc from runtime dependencies.
pnpm-lock.yaml	Updates the lockfile to remove angular-oauth2-oidc and its transitive tree.
helpers/string/errorToReadableMessage.ts	Replaces external OAuth error type import with a local structural type.
.github/workflows/job-security.yml	Converts security audit into a strict, failing CI step with configurable audit level.
.github/workflows/pr-validation.yml	Adds the security audit job and includes it in the PR status report.
.github/workflows/release.yml	Adds the security audit as a prerequisite for release build/verify.

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The type assertion here hard-codes type: "code_error", but the switch below has a default branch and the test suite exercises non-code_error values. This makes the types misleading (the default branch becomes unreachable to TypeScript) and increases the chance of future refactors accidentally breaking the non-code_error path. Consider asserting type: string (or a union of known types) and using a runtime check (if (errOAuth.type === "code_error") to narrow before accessing params.error / params.error_description.

[github-actions]

✅ PR Validation Passed

All checks passed and coverage target reached!

---

📋 Pipeline Status

	Job	Status
✅	🔢 Version	passing
✅	🏗️ Build	passing
✅	🧪 Tests	passing
✅	📝 Lint	passing
✅	📘 TypeCheck	passing
✅	🔐 Security Audit	passing
✅	🧾 Conventional Commits	passing
✅	🔗 Coherency	passing

---

📊 Code Coverage

✅ Overall Coverage: 100.0% — Target reached! 🎯

	Metric	Progress	Coverage
✅	Lines	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%
✅	Branches	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%
✅	Functions	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%
✅	Statements	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓	100%

---

🧬 Mutation Testing

🟡 Mutation Score: 88.44% — good

	Metric	Progress	Score
🟡	Mutation Score	▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░	88.44%

🧬 Mutation testing is informational only and does not block the PR

---

ℹ️ About this report

• 🎯 Coverage Target: 100% for all metrics
• 🧬 Mutation Testing: powered by Stryker (non-blocking)
• 🔄 This comment updates automatically with each push
• 📈 Coverage is measured using Vitest + v8

_{🤖 Generated by @helpers4 CI • 2026-04-02}