use npm ci instead of npm install in CI && npm audit (#29)

* use `npm ci` instead of `npm install` in CI

* add npm audit job

---------

Co-authored-by: Bart Veneman <[email protected]>

Author: bartveneman

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
         with:
           cache: "npm"
           node-version: 22
-      - run: npm install --ignore-scripts --no-audit --no-fund
+      - run: npm ci --ignore-scripts --no-audit --no-fund
       - run: npm test
 
   check:
@@ -33,7 +33,7 @@ jobs:
         with:
           cache: "npm"
           node-version: 22
-      - run: npm install --ignore-scripts --no-audit --no-fund
+      - run: npm ci --ignore-scripts --no-audit --no-fund
       - run: npm run check
 
   lint-package:
@@ -47,8 +47,22 @@ jobs:
         with:
           cache: "npm"
           node-version: 22
-      - run: npm install --ignore-scripts --no-audit --no-fund
+      - run: npm ci --ignore-scripts --no-audit --no-fund
       - name: Build package
         run: npm run build
       - name: Lint package
         run: npx publint
+
+  npm-audit:
+    name: Audit packages
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+      - name: Use Node.js
+        uses: actions/setup-node@v5
+        with:
+          cache: "npm"
+          node-version: 22
+      - name: npm audit
+        run: npm audit --audit-level=high