A Node.js Audit via Github Action to augment PR's

🎯 pnpm-audit v3 (v3.1.0): A Thoughtful Step Forward in Open Source Security

As a developer who cares deeply about dependency security and CI/CD efficiency, I’ve always looked for tools that strike the right balance between simplicity and usefulness.

The pnpm-audit project by @JamesRobertWiseman does exactly that — and with version 3.1.0, it takes a big step forward, addressing community feedback without overcomplicating its mission.

🏗️ Three community requests turned into features

1. Updated documentation and GitHub Action setup tips (Issue #2)

Community feedback highlighted the need for clearer documentation — examples, explanations of each parameter, and best practices for configuring pnpm-audit within GitHub Actions.

Version 3.1.0 now includes improved docs and practical setup guidance, making it easier than ever to integrate the audit step in modern CI/CD pipelines.

👉 A welcome enhancement for teams adopting the action for the first time.

(main Readme)

1. Inline annotations in workflow logs (Issue #3)

Another great addition: the inline flag now enables inline audit findings directly in GitHub’s workflow logs using annotation syntax.

👉 This makes audit results visible where developers already work — the CI output.

Here is a quick overview of an inline result:

1. Reduced noise having a single comment in pull requests (Issue #4)

No one likes PRs cluttered with repeated audit comments after every push.

The new single_comment option ensures only one comment is maintained and updated, and it’s automatically removed when all vulnerabilities are resolved.

👉 A small but powerful change that makes PRs much cleaner and easier to follow.

Here is a quick overview of a PR comment:

🚀 Why v3 stands out

This release shows what makes pnpm-audit great:

• Community-driven — user feedback quickly turned into real improvements.




• Practical — every feature adds real value for day-to-day development.




• Simple — easy to adopt, even easier to maintain.

Kudos to @JamesRobertWiseman for this thoughtful release — a great example of open source responsiveness done right.

🧩 Example GitHub Actions workflow

# continuous integration

name: main



# Controls when the action will run. 

on:

  push:

    branches: [ main ]

  pull_request:

  # Allows you to run this workflow manually from the Actions tab

  workflow_dispatch:



# A workflow run is made up of one or more jobs that can run sequentially or in parallel

jobs:

  # This workflow contains a single job called "build"

  build:

    # The type of runner that the job will run on

    runs-on: ubuntu-latest



    strategy:

      matrix:

        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

        node-version: [ 18.x ]



    steps:

      - name: Checkout code

        uses: actions/checkout@v5



      - name: Setup pnpm

        uses: pnpm/action-setup@v4

        with:

          # version from package.json

          run_install: false



      - name: Setup Node.js ${{ matrix.node-version }}

        uses: actions/setup-node@v5

        with:

          node-version: ${{ matrix.node-version }}

          cache: 'pnpm'



      - name: Install dependencies

        run: |

          echo ::group::Install dependencies

          echo "install"

          pnpm i --frozen-lockfile

          echo ::endgroup::



      - name: CHECK - pnpm audit and comment on PR

        if: ${{ github.event.pull_request }}

        uses: JamesRobertWiseman/pnpm-audit@v3

        with:

          github_token: ${{ secrets.GITHUB_TOKEN }}

          level: moderate   # 'low'|'moderate'|'high'|'critical'

          fails: true # true to fail the build if vulnerabilities are found

          single_comment: true # true to only post one comment

          inline: true # true to emit audit findings directly in the workflow logs using GitHub annotation syntax



      - name: Run tests

        run: pnpm ci-test



      - name: COVERAGE - Report coverage on pull request

        if: github.event_name == 'pull_request'

        continue-on-error: true

        uses: andybelltree/[email protected] # https://github.com/andybelltree/lcov-reporter-action/releases

        with:

          lcov-file: ./coverage/lcov.info

          filter-changed-files: true

JamesRobertWiseman/pnpm-audit@v3 step :

✅ single_comment: true → keeps the PR clean

✅ inline: true → annotations inside logs

✅ fails: true → breaks the build on critical issues

✨ Huge thanks to @JamesRobertWiseman for this outstanding update 🙌