概述
NPM 审计修复工作流是一个初级难度的工作流。运行 npm audit 识别漏洞并以可控方式应用修复，每次修复后测试。该工作流的目标是：Resolve known vulnerabilities in project dependencies without breaking the build.
环境准备
执行本工作流需要以下环境：A Node.js project with package-lock.json；NPM version 7 or later；CI pipeline that runs tests on push。请确保在开始前准备好所有必需的工具和资源，以避免中途因环境问题中断。
执行步骤
本工作流包含4个步骤。步骤1：Run npm audit——Execute npm audit to get a report of all vulnerabilities. 步骤2：Apply audit fix——Run npm audit fix to apply non-breaking fixes automatically. 步骤3：Run tests——Execute the full test suite to verify that fixes did not break anything. 步骤4：Review remaining——Run npm audit again to check for remaining vulnerabilities that need manual attention.
验证与清理
预期结果：All automatically fixable vulnerabilities are resolved, tests pass, and remaining vulnerabilities are documented for manual review.。验证方法：Run npm audit and confirm zero high or critical vulnerabilities; run the test suite and confirm all tests pass.。清理操作：Commit the updated package-lock.json and package.json if changed.。estimatedMinutes 为 20 分钟。
代码示例
npm audit
npm audit fix
npm test