Solutions · CI/CD

Audit packages in CI before merge

Editors catch risk when a human is watching. Agents and bots also open PRs at 2am. Put check_package in the pipeline so supply-chain red flags block the merge — same tool, same API key, no second product.

Problem

A dependency bump lands via Dependabot or an agent. Reviewers skim the lockfile. Nobody runs a live registry + risk check. Typosquats and abandoned packages slip through.

Before / after

• Before: “Looks fine, green CI” — agent invents safety claims.
• After: Job calls Zephex; PR comment or fail on critical risk flags; human sees structured evidence.

Tools / commands

• MCP: check_package with task=security or task=upgrade
• CLI: zephex safe <pkg> · zephex check-package <pkg> --task security --json

GitHub Actions (copy-paste)

1. Create a key at dashboard/api-keys
2. Add repo secret ZEPHEX_API_KEY (never commit the key)
3. Drop the workflow below; expand package list from the PR diff as needed

name: Zephex package safety
on:
  pull_request:
    paths:
      - "package.json"
      - "package-lock.json"
      - "pnpm-lock.yaml"
      - "yarn.lock"

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Audit changed deps with Zephex CLI
        env:
          ZEPHEX_API_KEY: ${{ secrets.ZEPHEX_API_KEY }}
        run: |
          npx --yes zephex check-package lodash --task security --json
          # Or: zephex safe <pkg> for human-readable output
          # Point --cwd at the package that changed in monorepos

Agent prompt in CI review bots

For each new or upgraded dependency in this PR:
call check_package(task=security) then task=upgrade if versions changed.
Block merge recommendation if critical supply-chain flags appear.
Do not invent CVE status from training data.

Catch malicious npm packages · Audit upgrades · More workflows · Security & data