Merge pull request #607 from Code-Paragon/feat/601-a11y-tests #150
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | ||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| - cron: '0 0 * * 0' # Weekly on Sunday | ||
| jobs: | ||
| dependency-audit: | ||
| name: Dependency Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| - name: Run npm audit (backend) | ||
| run: npm audit --audit-level=high | ||
| working-directory: backend | ||
| continue-on-error: true | ||
| - name: Run npm audit (frontend) | ||
| run: npm audit --audit-level=high | ||
| working-directory: frontend | ||
| continue-on-error: true | ||
| codeql: | ||
| name: CodeQL Analysis | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| security-events: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: javascript | ||
| - uses: github/codeql-action/autobuild@v3 | ||
| - uses: github/codeql-action/analyze@v3 | ||
| secret-scanning: | ||
| name: Secret Scanning | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Scan for secrets | ||
| uses: trufflesecurity/trufflehog@main | ||
| with: | ||
| extra_args: --only-verified | ||
| lint-security: | ||
| name: Security Linting | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| - name: Install eslint-security plugin | ||
| run: npm install --save-dev eslint-plugin-security | ||
| working-directory: backend | ||
| - name: Run security linting | ||
| run: npx eslint --plugin security --rule 'security/detect-object-injection: warn' src/ | ||
| working-directory: backend | ||
| continue-on-error: true | ||
| sql-injection-tests: | ||
| name: SQL Injection Prevention Tests | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: backend/package-lock.json | ||
| - name: Install dependencies | ||
| run: npm ci | ||
| working-directory: backend | ||
| - name: Run SQL injection test suite (strict mode) | ||
| run: npx jest --forceExit __tests__/sqlInjection.test.js --verbose | ||
| working-directory: backend | ||
| env: | ||
| SQL_INJECTION_BLOCK_POLICY: strict | ||
| NODE_ENV: test | ||
| - name: Run SQL injection test suite (warn mode coverage) | ||
| run: npx jest --forceExit __tests__/sqlInjection.test.js --verbose | ||
| working-directory: backend | ||
| env: | ||
| SQL_INJECTION_BLOCK_POLICY: warn | ||
| NODE_ENV: test | ||
