[PresentJay]

I tried a manual HTML view of html-minifier-terser's committed npm tree while exploring where this report is useful. I contribute to zero-shelter, and used AI assistance for this PR and validation. The saved audit reported no dependency findings; this proposal is for optional reporting.

Only .github/workflows/dependency-report.yml is added. Dependency triage report starts through workflow_dispatch and requests contents: read. It runs npm audit --package-lock-only --ignore-scripts, passes that one npm report to pinned zero-shelter@0.0.10, and retains generated HTML for 7 days. It installs no project dependencies, runs no project lifecycle scripts and accepts no baseline. Existing build, test and publishing workflows remain in place. Finding exit 1 and judgement-error exit 2 remain failures. Node 24 is used only for this report job.

Stored validation at f863b9431e23 had 0 raw records, 0 merged findings and 0 outstanding findings; audit, JSON and HTML commands exited 0. YAML, shell syntax and diff checks passed, and manifest and lockfile were unchanged. These are saved results, not a fresh scan. Application tests and a hosted manual run were not verified in that validation.

The report cannot establish runtime reachability or overall security. Audit sends dependency metadata to the configured registry; npx downloads and executes third-party CLI code in CI, even with a read-only repository token.

Would an occasional manual report fit your dependency review workflow? I can withdraw it if your current tooling already provides enough.

[PresentJay]

I contribute to zero-shelter and am exploring whether an occasional HTML dependency report is useful for html-minifier-terser. The saved npm capture had no findings. Would a manually requested artifact be worth having alongside your existing checks? I can withdraw it if your current tooling already gives you the dependency view you need.