Resolve audit warnings (#45)

* Update glob-parent to resolve CVE-2020-28469

* Run audit tasks on Ubuntu runners (they are cheaper)

* Audit only production dependencies

That is, something that can actually affect users of this action.
I don't really want to be bothered with yet another "prototype pollution"
or "denial of service" in transitive dependencies of eslint.

* Audit dev-dependencies for critical vulnerabilities

That said, still audit development dependencies for critical
vulnerabilities if they come along. Hopefully, this should be rare.

.github/workflows/main.yml

@@ -58,12 +58,13 @@ jobs:
           dumpbin /headers hello.exe
   audit:
     name: npm audit
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
     steps:
       - name: Check out source code
         uses: actions/checkout@v2
       - run: npm install
-      - run: npm audit --audit-level=moderate
+      - run: npm audit --audit-level=moderate --production
+      - run: npm audit --audit-level=critical
   alias-arch:
     name: arch aliases
     runs-on: windows-latest

.github/workflows/release.yml

@@ -23,8 +23,9 @@ jobs:
           hello.exe
   audit:
     name: npm audit
-    runs-on: windows-latest
+    runs-on: ubuntu-latest
     steps:
       - name: Check out source code
         uses: actions/checkout@v2
-      - run: npm audit --audit-level=moderate
+      - run: npm audit --audit-level=moderate --production
+      - run: npm audit --audit-level=critical

package-lock.json

@@ -531,9 +531,9 @@
       }
     },
     "node_modules/glob-parent": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz",
-      "integrity": "sha512-qjtRgnIVmOfnKUE3NJAQEdk+lKrxfw8t5ke7SXtfMTHcjsBfOfWXCQfdb30zfDoZQ2IRSIiidmjtbHZPZ++Ihw==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "dev": true,
       "dependencies": {
         "is-glob": "^4.0.1"
@@ -1690,9 +1690,9 @@
       }
     },
     "glob-parent": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.0.tgz",
-      "integrity": "sha512-qjtRgnIVmOfnKUE3NJAQEdk+lKrxfw8t5ke7SXtfMTHcjsBfOfWXCQfdb30zfDoZQ2IRSIiidmjtbHZPZ++Ihw==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
       "dev": true,
       "requires": {
         "is-glob": "^4.0.1"