dependency-scans.yml

name: Ruby and Javascript dependency scans

on:
  push:
    branches: [ main ]
    paths-ignore:
      - 'doc/**'
      - 'README.md'
  pull_request:
    branches: [ main ]
  schedule:
    # cron format: 'minute hour dayofmonth month dayofweek'
    # this will run at noon UTC every day (7am EST / 8am EDT)
    - cron: '0 12 * * *'

jobs:
  bundle-audit:
    name: Bundle audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2

      - uses: ./.github/actions/setup-languages

      - name: Update advisory database and run checks
        run: bundle exec rake bundler:audit

  yarn-audit:
    name: Yarn audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2

      - uses: ./.github/actions/setup-languages

      - name: Run yarn audit
        run: bundle exec rake yarn:audit