Security #109

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '0 0 * * 0' # Sunday midnight UTC

	# Cancel outdated runs when new commits are pushed
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	audit:
	name: Dependency Audit
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup pnpm
	uses: pnpm/action-setup@v4
	with:
	version: 9.15.4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: 22.x
	cache: 'pnpm'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Run npm audit
	run: pnpm audit --audit-level=moderate

	- name: Run Snyk security scan
	uses: snyk/actions/node@master
	continue-on-error: true
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

Provide feedback