[amilz]

• Add an audit job to CI that runs pnpm audit against the lockfile. It has no install step, so it finishes quickly.
• If an advisory has no fix yet, add its GHSA to auditConfig.ignoreGhsas in pnpm-workspace.yaml with a link to the upstream issue.
• AI tooling was used. Tool and extent: Claude Code ran the dependency audit, wrote the CI job and drafted this PR; I reviewed it.
• Closes TOO-1010

[linear]

TOO-1010

[greptile-apps]

Confidence Score: 4/5

[Low impact] The change reaches the repository's CI workflow, not application behavior.

Set the promised high-only audit threshold before merging.

Findings

1.  Lower-severity advisories fail CI ▶

Summary

Adds a standalone dependency audit job to CI.

• CI runs a dependency audit in its own job.

_{Reviews (1) · Last reviewed commit: "ci: add pnpm audit job" · Reviewed by Greptile}

[dev-jodee]

Adding pnpm audit job to CI. All checks pass.