perf(vuln-scan): audit the lock file instead of installing

[oxyc]

The nightly scan installed the entire project in order to audit it, then threw the installation away. It is the largest single line in the org's CI bill — 19 repos, every night — and almost all of it is scaffolding.

Where the time went

suomentyokalu run 30515814093, 90s total:

36s  Random delay           (removed separately)
23s  Post Setup project     saving caches
14s  Install dependencies   composer install
 9s  Setup project          Node + PHP + cache restores
 2s  Run vulnerability scan

The audit is 2 seconds. The other ~50s exists to populate vendor/ — and the workflow contains not one reference to vendor/.

The change

composer audit --locked reads composer.lock directly. Verified locally: 2s, and the same .advisories JSON shape the existing jq -e '.advisories' guard requires. Same advisory sources, since the wpsecadv repository is still configured.

That makes the install redundant, and with it all three caches and Node. The job becomes: checkout → PHP → auth → audit. The shared setup action is deliberately not used here — it installs Node and manages three caches this job has no use for.

Expected ~90s → ~15s per scan, ~19 × 30 runs a month.

The auto-update path still works on the lock alone

composer update -W / composer require calls gain --no-install, so they rewrite composer.json and composer.lock without materialising vendor/. This is what the flow already wanted: the PR it opens has always been a lock diff, and its post-update gate is composer validate --no-check-all --no-check-publish, which inspects composer.json against the lock rather than an installed tree.

The composer-update test suite runs on this PR and exercises those call sites.

Details worth reviewing

• PHP version is read from config.platform.php as the shared action does, rather than hardcoded, so repos on older PHP are unaffected.
• Yoast auth is guarded in the shell, not with if: — secrets.* is unavailable in step-level if: inside a reusable workflow, which this repo already fixed once in 2702182.
• Repository auth is retained. --locked resolves nothing, but composer still loads metadata from configured repositories and the private ones 401 without credentials.

Verification plan

Timing on a real repo via a temporary pin, with auto_update: false so no spurious PRs are opened. The vulns-found path needs a genuine finding to exercise end to end; the composer-update tests cover the script changes in the meantime.

🤖 Generated with Claude Code