Merge pull request #420 from lovesmilesmall-hue/main #99
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: '30 2 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [javascript-typescript] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@a35ac6e6798d72df5475948b28efb89edc2e19ca # v4.37.9 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@a35ac6e6798d72df5475948b28efb89edc2e19ca # v4.37.9 | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@a35ac6e6798d72df5475948b28efb89edc2e19ca # v4.37.9 | |
| with: | |
| category: /language:${{ matrix.language }} | |
| dependency-review: | |
| name: Dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| # Requires the repository's "Dependency graph" setting to be enabled | |
| # (Settings → Code security and analysis). Until that is flipped, the | |
| # action exits with "Dependency review is not supported on this | |
| # repository"; the step is advisory so CI stays green, and becomes a | |
| # blocking gate as soon as the setting is enabled. | |
| - name: Review dependency changes | |
| continue-on-error: true | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: runtime, development | |
| # Residual-risk advisories accepted for the current Next.js 14.x | |
| # toolchain (see SECURITY.md → "Dependency audit status"). They only | |
| # clear with the Next.js 16 major upgrade; allow-listing them keeps | |
| # this gate strict (any *new* advisory still fails the check). | |
| allow-ghsas: | | |
| GHSA-9g9p-9gw9-jx7f | |
| GHSA-h25m-26qc-wcjf | |
| GHSA-ggv3-7p47-pfv8 | |
| GHSA-3x4c-7xq6-9pq8 | |
| GHSA-q4gf-8mx6-v5v3 | |
| GHSA-8h8q-6873-q5fj | |
| GHSA-3g8h-86w9-wvmq | |
| GHSA-ffhc-5mcf-pf4q | |
| GHSA-vfv6-92ff-j949 | |
| GHSA-gx5p-jg67-6x7h | |
| GHSA-h64f-5h5j-jqjh | |
| GHSA-c4j6-fc7j-m34r | |
| GHSA-wfc6-r584-vfw7 | |
| GHSA-36qx-fr4f-26g5 | |
| GHSA-m99w-x7hq-7vfj | |
| GHSA-89xv-2m56-2m9x | |
| GHSA-68g3-v927-f742 | |
| GHSA-4633-3j49-mh5q | |
| GHSA-4c39-4ccg-62r3 | |
| GHSA-p9j2-gv94-2wf4 | |
| GHSA-955p-x3mx-jcvp | |
| GHSA-qx2v-qp2m-jg93 | |
| GHSA-6g55-p6wh-862q | |
| GHSA-fxqj-rqcc-2cmp | |
| GHSA-r28c-9q8g-f849 | |
| secret-scan: | |
| name: Secret scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout full history | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | |
| with: | |
| fetch-depth: 0 | |
| # Runs the gitleaks CLI directly instead of gitleaks/gitleaks-action | |
| # because that action requires a (free) GITLEAKS_LICENSE secret for | |
| # organization-owned repositories. The pinned release binary keeps this | |
| # job self-contained; the SARIF report is uploaded to code scanning so | |
| # findings surface alongside CodeQL alerts. | |
| - name: Scan repository history for secrets | |
| run: | | |
| curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks | |
| ./gitleaks git --redact --no-banner --exit-code=1 \ | |
| --report-format sarif --report-path gitleaks.sarif | |
| - name: Upload SARIF to code scanning | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@a35ac6e6798d72df5475948b28efb89edc2e19ca # v4.37.9 | |
| with: | |
| sarif_file: gitleaks.sarif | |
| - name: Upload SARIF artifact | |
| if: always() | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: gitleaks-sarif | |
| path: gitleaks.sarif | |
| if-no-files-found: warn | |
| retention-days: 7 |