[PresentJay]

This offers a manual npm report for Graphlib’s locked development toolchain. Graphlib declares no regular runtime dependencies. I help develop zero-shelter and am trying its report in existing projects to learn whether that extra view is useful.

This adds only Dependency triage report, a separate workflow_dispatch workflow. It reads npm audit JSON with --package-lock-only --ignore-scripts, renders it using zero-shelter@0.0.10, and retains an HTML artifact for seven days. It requests contents: read, installs no project dependencies and accepts no baseline findings. Finding exit 1 and judgement-error exit 2 are both failures.

At base 0438a8f5c33d, the recorded 2026-11-02 UTC local check produced 4 raw / 4 merged / 4 outstanding / 0 accepted findings. npm audit and both JSON/HTML commands exited 1; a synthetic scanner failure returned 2. YAML, shell syntax and whitespace checks passed, and manifest/lockfile hashes were unchanged. This used only npm audit input and has not been rescanned. Graphlib's tests/build and the new hosted manual workflow were not run.

npm audit contacts the configured registry, and npx downloads and executes third-party code in CI. Read-only permissions limit repository access but do not remove that trust boundary. Reachability and exploitability were not assessed. I used AI assistance for this PR.

Would this report be useful for reviewing the development toolchain? I’m happy to withdraw it if another workflow would add little to your current process.

[PresentJay]

I contribute to zero-shelter and proposed this for Graphlib’s locked development toolchain, since the package has no regular runtime dependencies. Would a manual HTML view of those npm advisories be useful for maintenance, or would it be redundant with how you already review the tooling?