name: npmscan

on:
  pull_request:
    paths:
      - package.json
      - package-lock.json

permissions:
  contents: read
  pull-requests: write

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: NPMscan/npmscan-action@de14168f65640a4ed1f0e82ad3ad8c80483d360d # v1.3.0
        with:
          file: package-lock.json
          mode: warn
          fail-on-error: false