feat(governance): implement Governance Voting Dashboard with Real-Tim… #61
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Scan | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| push: | |
| branches: ["main"] | |
| schedule: | |
| - cron: "17 3 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| pull-requests: read | |
| concurrency: | |
| group: dependency-security-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Review dependency changes | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| deny-licenses: GPL-2.0, GPL-3.0, AGPL-1.0, AGPL-3.0 | |
| comment-summary-in-pr: always | |
| npm-audit: | |
| name: npm audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Use Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run npm vulnerability audit | |
| run: npm run security:audit | |
| - name: Upload npm audit report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: npm-audit-report | |
| path: reports/security/npm-audit.json | |
| if-no-files-found: ignore | |
| retention-days: 30 | |
| osv-scan: | |
| name: OSV dependency scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Run OSV scanner | |
| uses: google/osv-scanner-action/osv-scanner-action@v2.2.2 | |
| with: | |
| scan-args: |- | |
| --lockfile=package-lock.json | |
| results-file-name: osv-results.sarif | |
| - name: Upload OSV report artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: osv-results | |
| path: osv-results.sarif | |
| if-no-files-found: ignore | |
| retention-days: 30 |