config-npm.yml

name: Config npm
on:
  pull_request:
    paths:
      - .github/workflows/config-npm.yml
      - package.json
      - package-lock.json
  push:
    branches:
      - main
    paths:
      - .github/workflows/config-npm.yml
      - package.json
      - package-lock.json

permissions: read-all

jobs:
  package-json:
    name: package.json
    runs-on: ubuntu-24.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          persist-credentials: false
      - name: Install Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Validate package.json
        run: npm run check:manifest
  package-lock-json:
    name: package-lock.json
    runs-on: ubuntu-24.04
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            actions-results-receiver-production.githubapp.com:443
            api.github.com:443
            artifactcache.actions.githubusercontent.com:443
            github.com:443
            gitlab.com:443
            nodejs.org:443
            objects.githubusercontent.com:443
            registry.npmjs.org:443
      - name: Checkout repository
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with:
          persist-credentials: false
      - name: Install Node.js
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          cache: npm
          node-version-file: .nvmrc
      - name: Install dependencies
        run: npm clean-install
      - name: Validate package-lock.json
        run: npm run check:lockfile