name: Lockfile lint

# Security: Do not replace `pull_request` with `pull_request_target` to expose secrets or
# GITHUB_TOKEN write access to PR code. pull_request_target runs untrusted fork PR code with
# base-branch privileges.

on:
  pull_request:
    paths:
      - 'package-lock.json'
    types:
      - opened
      - synchronize
      - reopened

jobs:
  lockfile-lint:
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Validate package-lock.json
        run: npx --yes lockfile-lint@5 --path package-lock.json --type npm --validate-https --allowed-hosts registry.npmjs.org