npm-audit.yml

name: Npm Audit

on: 
 schedule:
   # * is a special character in YAML so you have to quote this string
   - cron:  '0 23 * * 0'

jobs:
  audit:
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout
      uses: actions/checkout@v2
      
    - name: Cache node modules
      id: cache-npm
      uses: actions/cache@v2
      env:
        cache-name: cache-node-modules
      with:
        # npm cache files are stored in `~/.npm` on Linux/macOS
        path: ~/.npm
        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
        restore-keys: |
          ${{ runner.os }}-build-${{ env.cache-name }}-
          ${{ runner.os }}-build-
          ${{ runner.os }}-
    
    - name: Install Dependencies
      run: npm ci
      
    - name: Npm audit
      uses: oke-py/npm-audit-action@v1.5.2
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}
        issue_assignees: lanaebk
        issue_labels: vulnerability
        dedupe_issues: true