deps: Update audit-ci implementation

[quinnturner]

I am the author of audit-ci. I noticed this project was using it, and I wanted to help out!

• Install latest audit-ci devDependency
• Use yarn dlx instead of installed version in CI
• Use .audit-ci.jsonc for better advisory management
• Remove unused yarn install during the pipeline
• Updates settings.json in VSCode to hide .audit-ci.jsonc
• Removes unused advisory 1005059

I do have a separate approach for you to consider: run audit-ci immediately after running actions/setup-nodeand before the yarn install with yarn dlx in the release workflow. That way, if there's a compromised dependency that runs a postinstall in the release, you will catch it before it installs.

👮🏻👮🏻👮🏻 !!!! REFERENCE THE PROBLEM YOUR ARE SOLVING IN THE PR TITLE AND DESCRIBE YOUR SOLUTION HERE !!!! DO NOT FORGET !!!! 👮🏻👮🏻👮🏻

PR Checklist:

• Have you read the CONTRIBUTING.md?
• Does your PR follow the C4 patch requirements?
• Have you rebased your work on top of the latest master?
• Have you checked your code compiles? (yarn build)
• Have you included tests for any non-trivial functionality?
• Have you checked your code passes the unit tests? (yarn test)
• Have you checked your code formatting is correct? (yarn lint:js)
• If you added any dependencies, have you checked they do not contain any known vulnerabilities? (yarn audit)
• If your changes affect public APIs, does your PR follow the C4 evolution of public contracts?
• If your code changes public APIs, have you incremented the crate version numbers and documented your changes in the CHANGELOG.md?
• If you are contributing for the first time, please read the agreement in CONTRIBUTING.md now and add a comment to this pull request stating that your PR is in accordance with the Developer's Certificate of Origin.

Thank you for your code, it's appreciated! :)

[lgtm-com]

This pull request introduces 27 alerts when merging 6960446 into cc73b5c - view on LGTM.com

new alerts:

• 16 for Unused variable, import, function or class
• 8 for Useless assignment to local variable
• 1 for Useless conditional
• 1 for Comparison between inconvertible types
• 1 for Incomplete string escaping or encoding

[lgtm-com]

This pull request introduces 27 alerts when merging 4f8fc44 into cc73b5c - view on LGTM.com

new alerts:

• 16 for Unused variable, import, function or class
• 8 for Useless assignment to local variable
• 1 for Useless conditional
• 1 for Comparison between inconvertible types
• 1 for Incomplete string escaping or encoding

[lgtm-com]

This pull request introduces 27 alerts when merging f84e60d into cc73b5c - view on LGTM.com

new alerts:

• 16 for Unused variable, import, function or class
• 8 for Useless assignment to local variable
• 1 for Useless conditional
• 1 for Comparison between inconvertible types
• 1 for Incomplete string escaping or encoding

[lgtm-com]

This pull request introduces 27 alerts when merging 42df653 into cc73b5c - view on LGTM.com

new alerts:

• 16 for Unused variable, import, function or class
• 8 for Useless assignment to local variable
• 1 for Useless conditional
• 1 for Comparison between inconvertible types
• 1 for Incomplete string escaping or encoding

[quinnturner]

Suggested change

	/.yarn/*
	!/.yarn/releases
	.yarn/*
	# Uncomment !.yarn/cache/ if you want Zero-Installs
	# !.yarn/cache
	!.yarn/patches
	!.yarn/plugins
	!.yarn/releases
	!.yarn/sdks
	!.yarn/versions

[quinnturner]

I don't recommend doing this. You should add the Yarn release to git based on the gitignore I suggested in this review. Yarn with automatically pick it up.

[quinnturner]

I don't think this should be necessary.

[quinnturner]

You can also just use npx if you want. It doesn't matter which dependency manager's task runner you use, audit-ci will look at lock files. I usually use npx regardless of the dependency manager tbh since it seems quicker.

[quinnturner]

I usually use this for Yarn Berry pipeline installations for caching purposes:

      - name: Prepare for install
        run: |
          echo -e "logFilters:\n  - code: YN0013\n    level: discard\n" > ~/.yarnrc.yml
      - name: Get yarn cache directory path
        id: yarn-cache-dir-path
        run: |
          echo "::set-output name=dir::$(yarn config get cacheFolder)"
          echo -e "Yarn cache directory: $(yarn config get cacheFolder)"
      - name: Cache Yarn
        uses: actions/cache@v3
        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
        with:
          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
          key: yarn-cache-folder-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
          restore-keys: |
            yarn-cache-folder-
      - name: Install dependencies
        run: yarn install --immutable

[quinnturner]

I'd recommend going with [email protected]