Security
Add npm audit, Gitleaks secret detection, Trivy vulnerability scanning and OSV-Scanner to your project and its GitHub Actions pipeline.
npm audit
Dependency vulnerability check — runs npm audit as part of your workflow.
- ID:
audit - Category: Security
What it does
- Adds
auditandaudit:fixscripts - Optionally adds CI step for vulnerability checking
Gitleaks
Secret scanning — prevents committing API keys, tokens, and other secrets.
- ID:
gitleaks - Category: Security
What it does
- Creates
.gitleaks.tomlconfiguration - Adds a GitHub Actions workflow (
.github/workflows/gitleaks.yml) - Configures rules for common secret patterns
Trivy
Container & filesystem vulnerability scanner — scans Docker images and project files.
- ID:
trivy - Category: Security
What it does
- Creates a
trivy.yamlconfiguration - Adds CI workflow for Trivy scanning
- Configures severity thresholds
OSV-Scanner
OSS vulnerability database — checks dependencies against the OSV (Open Source Vulnerability) database.
- ID:
osv-scanner - Category: Security
What it does
- Adds OSV-Scanner GitHub Actions workflow
- Configures scanning for
package-lock.json/pnpm-lock.yaml
Releases
Automate versioning, changelog generation and npm publishing with release-it, Changesets or semantic-release, for single packages and monorepos.
Dev Environment
Automate the developer environment: pin the Node.js version with .nvmrc, generate .env.example, configure VSCode and add a Dev Container.