Add workflow to automatically build for npm changes

[lucacome]

Adds workflow to automatically build for npm changes

[lucacome]

@kzantow any ideas why the checks failed? Would it be possible to re-run them?

[kzantow]

There is a bit of a problem enabling dependabot on this repository: the dist/index.js needs to be regenerated for any dependencies which have code included in it (needs an npm install and npm run build, basically), but there is no way to cause this to happen with dependabot PRs that I'm aware of. Do you have any suggestions how to cause this to happen?

[lucacome]

We can do it with a GitHub action using https://github.com/dependabot/fetch-metadata
I can create a workflow and add it to this PR if you think that would work.

[kzantow]

Hi @lucacome if you feel like adding a workflow for this, that would be great!

It basically just needs to run npm run build and add the changes in the dist/ folder to the dependabot PR.

[lucacome]

@kzantow finally got around to adding the workflow.
You need to add a PAT for the workflow to work (I called it COMMIT_PAT) in https://github.com/anchore/scan-action/settings/secrets/dependabot for dependabot.
It's possible to commit without a PAT but it will not re-trigger the workflow after the commit.

[kzantow]

Trying to move this forward, we needed some dependabot PRs to test this workflow with, so we went ahead and enabled dependabot in this PR and will revisit this PR to enable automatic update of dist/js files and auto merging of passing dependency updates.

[lucacome]

Thanks @kzantow I've rebased the PR