From 290549d3a41b1f9097ce9bd39c2fbbf04b8eb8e4 Mon Sep 17 00:00:00 2001
From: Hendrik Belitz <hendrik@innovation-through-understanding.de>
Date: Sat, 7 Feb 2026 11:31:26 +0100
Subject: [PATCH] Add npm audit to pipelines. Add trivy scan to release.

---
 .github/workflows/main-deploy.yml |  3 +++
 .github/workflows/pr-checks.yml   |  4 ++++
 .github/workflows/release.yml     | 15 ++++++++++++++-
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/main-deploy.yml b/.github/workflows/main-deploy.yml
index 0e06d1c..7b3372a 100644
--- a/.github/workflows/main-deploy.yml
+++ b/.github/workflows/main-deploy.yml
@@ -21,6 +21,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Security audit
+        run: npm audit --audit-level=high
+
       - name: Run type checking
         run: npm run check
 
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index 74bf10b..643097f 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -21,6 +21,10 @@ jobs:
 
       - name: Install dependencies
         run: npm ci
+
+      - name: Security audit
+        run: npm audit --audit-level=high
+
       - name: Run linting
         run: npm run lint
   check:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f245665..8c37478 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -62,7 +62,20 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push Docker images
+      - name: Build Docker image
+        run: docker build -t openreception/open-reception:${{ github.ref_name }} .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "openreception/open-reception:${{ github.ref_name }}"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
+
+      - name: Push Docker images
         run: npm run docker:build-and-push
 
       - name: Create Release Archive