ci(deps): audit reviewed npm archive graph

.github/actions/ci-reviewed-npm-audit/action.yaml

@@ -0,0 +1,25 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: ci-reviewed-npm-audit
+description: Materialize and audit the reviewed production npm graphs.
+
+runs:
+  using: composite
+  steps:
+    - name: Setup production-compatible Node.js
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      with:
+        node-version: "22.22.2"
+
+    - name: Materialize and audit reviewed npm graphs
+      shell: bash
+      run: node --experimental-strip-types scripts/audit-reviewed-npm-graph.mts
+
+    - name: Upload reviewed npm audit reports
+      if: always()
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: reviewed-npm-audit
+        path: coverage/reviewed-npm-audit/*.json
+        if-no-files-found: error

.github/workflows/main.yaml

@@ -57,6 +57,18 @@ jobs:
       - name: Run installer integration tests
         uses: ./.github/actions/ci-installer-integration
 
+  reviewed-npm-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Audit reviewed production npm graphs
+        uses: ./.github/actions/ci-reviewed-npm-audit
+
   real-openclaw-dist-harness:
     runs-on: ubuntu-latest
     timeout-minutes: 20
@@ -213,6 +225,7 @@ jobs:
       - static-checks
       - build-typecheck
       - installer-integration
+      - reviewed-npm-audit
       - real-openclaw-dist-harness
       - cli-tests
       - plugin-tests
@@ -227,6 +240,7 @@ jobs:
           STATIC_RESULT: ${{ needs['static-checks'].result }}
           BUILD_TYPECHECK_RESULT: ${{ needs['build-typecheck'].result }}
           INSTALLER_INTEGRATION_RESULT: ${{ needs['installer-integration'].result }}
+          REVIEWED_NPM_AUDIT_RESULT: ${{ needs['reviewed-npm-audit'].result }}
           REAL_OPENCLAW_DIST_HARNESS_RESULT: ${{ needs['real-openclaw-dist-harness'].result }}
           CLI_TESTS_RESULT: ${{ needs['cli-tests'].result }}
           PLUGIN_TESTS_RESULT: ${{ needs['plugin-tests'].result }}
@@ -247,6 +261,7 @@ jobs:
           require_success "static-checks" "$STATIC_RESULT"
           require_success "build-typecheck" "$BUILD_TYPECHECK_RESULT"
           require_success "installer-integration" "$INSTALLER_INTEGRATION_RESULT"
+          require_success "reviewed-npm-audit" "$REVIEWED_NPM_AUDIT_RESULT"
           require_success "real-openclaw-dist-harness" "$REAL_OPENCLAW_DIST_HARNESS_RESULT"
           require_success "cli-tests" "$CLI_TESTS_RESULT"
           require_success "plugin-tests" "$PLUGIN_TESTS_RESULT"

.github/workflows/pr.yaml

@@ -192,6 +192,20 @@ jobs:
         shell: bash
         run: CI=true npx vitest run --project installer-integration
 
+  reviewed-npm-audit:
+    needs: changes
+    if: needs.changes.outputs.code == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Audit reviewed production npm graphs
+        uses: ./.github/actions/ci-reviewed-npm-audit
+
   cli-test-shards:
     needs: changes
     if: needs.changes.outputs.code == 'true'
@@ -366,6 +380,7 @@ jobs:
       - static-checks
       - build-typecheck
       - installer-integration
+      - reviewed-npm-audit
       - cli-tests
       - plugin-tests
       - e2e-support
@@ -382,6 +397,7 @@ jobs:
           STATIC_RESULT: ${{ needs['static-checks'].result }}
           BUILD_TYPECHECK_RESULT: ${{ needs['build-typecheck'].result }}
           INSTALLER_INTEGRATION_RESULT: ${{ needs['installer-integration'].result }}
+          REVIEWED_NPM_AUDIT_RESULT: ${{ needs['reviewed-npm-audit'].result }}
           CLI_TESTS_RESULT: ${{ needs['cli-tests'].result }}
           PLUGIN_TESTS_RESULT: ${{ needs['plugin-tests'].result }}
           E2E_SUPPORT_RESULT: ${{ needs['e2e-support'].result }}
@@ -417,6 +433,7 @@ jobs:
             require_success "static-checks" "$STATIC_RESULT"
             require_success "build-typecheck" "$BUILD_TYPECHECK_RESULT"
             require_success "installer-integration" "$INSTALLER_INTEGRATION_RESULT"
+            require_success "reviewed-npm-audit" "$REVIEWED_NPM_AUDIT_RESULT"
             require_success "cli-tests" "$CLI_TESTS_RESULT"
             require_success "plugin-tests" "$PLUGIN_TESTS_RESULT"
             require_success "e2e-support" "$E2E_SUPPORT_RESULT"
@@ -426,6 +443,7 @@ jobs:
             allow_success_or_skipped "static-checks" "$STATIC_RESULT"
             allow_success_or_skipped "build-typecheck" "$BUILD_TYPECHECK_RESULT"
             allow_success_or_skipped "installer-integration" "$INSTALLER_INTEGRATION_RESULT"
+            allow_success_or_skipped "reviewed-npm-audit" "$REVIEWED_NPM_AUDIT_RESULT"
             allow_success_or_skipped "cli-tests" "$CLI_TESTS_RESULT"
             allow_success_or_skipped "plugin-tests" "$PLUGIN_TESTS_RESULT"
             allow_success_or_skipped "e2e-support" "$E2E_SUPPORT_RESULT"