1.0.3 #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '17 3 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@a2983b8bed1923f44751c5c43237f479442827b3 # v3 | |
| with: | |
| languages: javascript-typescript | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@a2983b8bed1923f44751c5c43237f479442827b3 # v3 | |
| dependency-review: | |
| name: Dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| # Downgraded to advisory: this action needs the repository Dependency | |
| # graph enabled (Settings > Code security and analysis), which requires | |
| # org admin access. Once enabled, drop continue-on-error to re-gate. | |
| # Introduced vulnerabilities are still blocked by audit:prod in ci.yml. | |
| - name: Review dependency changes | |
| continue-on-error: true | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| secrets: | |
| name: Secret scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a GITLEAKS_LICENSE for organization | |
| # accounts. Run the open-source CLI directly instead so the scan stays | |
| # license-free while still covering full git history (fetch-depth: 0). | |
| - name: Scan repository history | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C "$RUNNER_TEMP" gitleaks | |
| "$RUNNER_TEMP/gitleaks" version | |
| "$RUNNER_TEMP/gitleaks" detect --source . --redact --no-banner --verbose |