[Feature] Security Pipeline

[jskoll]

This PR is being created as part of a class (SENG 540) at WVU (West Virginia University). The class was about software evolution. The group I was in decided to look at the evolution of DevOps into DevSecOps. This PR adds some security related steps into the pipeline.

The PR adds a new GitHub action called Security Checks that:

1. Runs on ubuntu-latest
2. Runs against Node 10, 12, and 14
3. Runs a npm install
4. Runs npm audit against production packages with the audit level set at moderate
5. Runs another npm audit against the entire package with the audit level set at critical
6. Runs a static analysis tool twly to look for duplicated code.

This pipeline is setup this way to avoid any known security issue above moderate from being used within the production builds of npm and to give more visibility of security issues within dev-dependencies.

twly itself is not necessarily a security tool but the idea of having it included is to help keep the npm code DRY (Don't Repeat Yourself). This will help security overall by ensuring that any bug/security issue found in the code will only need to be fixed in less spots (hopefully just one). This tool is configurable through the .trc file and is currently setup to fail at anything below a threshold of 95. As configured it will only look the src folder and report duplicates if a minimum of 5 lines and 50 characters are found duplicated.

Also in this PR is a dependabot config file. This is in here to help maintain up-to-date dependencies, it is configured to run once a week.

This PR was the work of:

• Me (@jskoll)
• Tony (@atomaro)
• Jason (@jpschafer)
• Mike (@michaelhm)

[jpschafer]

Thank you npm CLI team for giving us the opportunity to speak today, this was an eye-opening experience on how contributing to FOSS works, and this helped break the ice for us moving forward if we decide to contribute more in the future.

[michaelhm]

Hey npm team, just wondering if there's any status updates regarding this PR?

[darcyclarke]

@jskoll appreciate the work you & your team did. We're going to go through our own automation overhaul in the near future which will include Actions dedicated to security/vulnerability gates that are different than the tooling you've presented here. Again, want to thank you very much for considering how we can improve the safety/security of npm & we'll definitely use this as the standard as we implement our own checks moving forward.