From 0d5f5422c444b0c3684a7d980fa73da83872756b Mon Sep 17 00:00:00 2001 From: Mark Stuart Date: Tue, 18 Aug 2026 14:52:41 -0700 Subject: [PATCH] fix(ci): run security audit in the npm/ directory This repo keeps package.json under npm/ rather than the repo root, so the audit job failed with ENOENT on install. Matches the working-directory convention already used by ci.yml. --- .github/workflows/security-audit.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index b218b03..d6ab9e5 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -33,6 +33,7 @@ jobs: # Some repos intentionally ship without a committed lockfile; `npm ci` # requires one, so fall back to `npm install` in that case. - name: Install dependencies + working-directory: npm run: | if [ -f package-lock.json ]; then npm ci @@ -42,6 +43,7 @@ jobs: - name: Run npm audit id: audit + working-directory: npm run: | # npm audit exits non-zero when it finds anything; capture rather than fail. npm audit --audit-level=high --json > audit.json || true