chore(deps): bump multer from 2.2.0 to 2.3.0 #224
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 6 * * 1' | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node-version: [20, 22] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run ESLint | |
| run: npm run lint | |
| - name: Validate docker-compose consistency (Issue #404) | |
| run: node scripts/check-compose-consistency.js | |
| - name: Validate .env.example vs required env (Issue # env-sync) | |
| run: node scripts/check-env-example.js | |
| deadcode: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Check for dead code | |
| run: npm run deadcode:production | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| build-and-scan: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build Docker image | |
| run: docker build -t audioblock-backend . | |
| - name: Scan base image (node:20) | |
| id: scan-base | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@0.29.0 | |
| with: | |
| image-ref: node:20 | |
| format: sarif | |
| output: trivy-base-results.sarif | |
| exit-code: 1 | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| trivyignores: .trivyignore | |
| - name: Scan final image | |
| id: scan-final | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@0.29.0 | |
| with: | |
| image-ref: audioblock-backend | |
| format: sarif | |
| output: trivy-final-results.sarif | |
| exit-code: 1 | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| trivyignores: .trivyignore | |
| - name: Upload SARIF results (base) | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: trivy-base-results.sarif | |
| category: trivy-base | |
| - name: Upload SARIF results (final) | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: trivy-final-results.sarif | |
| category: trivy-final | |
| - name: Archive scan results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: trivy-results-${{ github.sha }} | |
| path: | | |
| trivy-base-results.sarif | |
| trivy-final-results.sarif | |
| retention-days: 90 | |
| - name: Block merge on critical/high findings | |
| if: (github.event_name == 'push' || github.event_name == 'pull_request') && (steps.scan-base.outcome == 'failure' || steps.scan-final.outcome == 'failure') | |
| run: exit 1 |