fix: package.json & package-lock.json to reduce vulnerabilities (#1266) #487

	name: Code analysis

	on:
	# Trigger analysis when pushing in master or pull requests, and when creating
	# a pull request.
	push:
	branches:
	- master
	pull_request:
	types: [opened, synchronize, reopened]

	jobs:
	analysis:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v2
	with:
	# Disabling shallow clone is recommended for improving relevancy of reporting
	fetch-depth: 0
	- name: Detect Node version from .nvmrc
	id: node_version
	run: echo "::set-output name=nvmrc::$(cat .nvmrc)"

	- uses: actions/setup-node@v2
	with:
	node-version: ${{ steps.node_version.outputs.nvmrc }}

	- name: npm-ci
	run: npm ci

	- name: test
	run: npm run coverage

	- name: Codecov Scan
	uses: codecov/codecov-action@v2
	with:
	token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
	files: ./coverage/clover.xml
	flags: unittests # optional
	verbose: true # optional (default = false)

	- name: SonarCloud Scan
	uses: sonarsource/sonarcloud-github-action@master
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

	- name: Initialize CodeQL
	uses: github/codeql-action/init@v1
	with:
	languages: typeScript

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v1

Provide feedback