build(deps): bump step-security/harden-runner from 2.14.2 to 2.15.0 #9

	name: Fix Dependabot lockfile

	on:
	pull_request:
	branches: [main, next]

	permissions:
	contents: write
	pull-requests: read

	jobs:
	fix-lockfile:
	name: Fix lockfile
	runs-on: ubuntu-latest
	if: github.actor == 'dependabot[bot]'
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
	with:
	egress-policy: audit

	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	ref: ${{ github.head_ref }}
	token: ${{ secrets.GITHUB_TOKEN }}

	- name: Setup Node.js
	uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
	with:
	node-version: 22

	- name: Regenerate lockfile
	run: npm install --package-lock-only --ignore-scripts

	- name: Commit updated lockfile
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"
	git add package-lock.json
	if git diff --cached --quiet; then
	echo "Lockfile is already in sync"
	else
	git commit -m "fix: regenerate package-lock.json"
	git push
	fi

Navigation Menu