fix(aider): pin litellm version to prevent startup value error" -m "-… #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "🛡️ Security & Vulnerability Scan" | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| repository_dispatch: | |
| types: [ trigger-security-scan ] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_OWNER: migoller | |
| jobs: | |
| # Job 1: Triggers on EVERYTHING (Push, PR, Webhook, Manual) to scan repository files | |
| static-analysis: | |
| name: Repository Static Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner (SARIF Mode) | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH' | |
| scanners: 'vuln,misconfig,secret' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| # Job 2: ONLY triggers via Webhook (repository_dispatch) or Manual (workflow_dispatch) | |
| registry-image-scan: | |
| name: GHCR Registry Image Scan | |
| runs-on: ubuntu-latest | |
| if: | | |
| github.event_name == 'repository_dispatch' || | |
| github.event_name == 'workflow_dispatch' | |
| permissions: | |
| security-events: write | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| flavor: [hermes, aider, claude-code] | |
| steps: | |
| - name: Run Trivy scanner on GHCR ${{ matrix.flavor }} image | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: 'image' | |
| image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/ai-agent-sandbox-${{ matrix.flavor }}:latest' | |
| format: 'sarif' | |
| output: 'trivy-${{ matrix.flavor }}-registry.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Registry scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-${{ matrix.flavor }}-registry.sarif' | |
| category: 'registry-${{ matrix.flavor }}' |