chore(deps): bump undici from 7.28.0 to 7.29.0 in /board #216
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Fast quality + security gates on every push/PR. Heavy e2e (Redis/Kafka) and | |
| # chaos/mutation/bench run in nightly.yml. Actions use version tags; Dependabot | |
| # (github-actions) + a follow-up SHA-pin pass harden these further. | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| quality: | |
| name: Quality (lint · typecheck · 100% coverage · arch) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| - run: npm ci | |
| - name: Lint (zero errors) | |
| run: npm run lint | |
| - name: Typecheck (zero errors) | |
| run: npm run typecheck | |
| - name: Architecture (no circular imports) | |
| run: npm run lint:arch | |
| - name: API surface gate (api-extractor — fails on undocumented public-API drift) | |
| run: npm run api:check | |
| - name: Unit tests + coverage (enforced 100% of src/**) | |
| run: npm run test:coverage | |
| - name: Upload coverage report | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: coverage | |
| path: coverage/ | |
| board: | |
| name: Board UI (audit · typecheck · build · tests) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: board | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| cache-dependency-path: board/package-lock.json | |
| - run: npm ci | |
| # Gate the board on HIGH+ advisories too (root has this; the board | |
| # previously had no audit step, which let an esbuild HIGH go uncaught). | |
| - name: Dependency audit (fail on HIGH+) | |
| run: npm audit --audit-level=high | |
| # `build` is `tsc --noEmit && vite build` — typechecks then bundles. | |
| - run: npm run build | |
| - run: npm test | |
| security: | |
| name: Security (audit · secrets · SBOM · OSV) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| - run: npm ci | |
| - name: Dependency audit (fail on HIGH+; moderates triaged in SECURITY.md) | |
| run: npm audit --audit-level=high | |
| - name: Generate CycloneDX 1.6 SBOM | |
| # --ignore-npm-errors: `npm ls` exits non-zero on a harmless dev-only peer | |
| # mismatch (madge→precinct wants TypeScript 5.x while the project pins 6.x); | |
| # the installed tree is valid, so the SBOM is still complete and accurate. | |
| run: npx --yes @cyclonedx/cyclonedx-npm@latest --ignore-npm-errors --output-format JSON --spec-version 1.6 --output-file sbom.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom-cyclonedx | |
| path: sbom.json | |
| - name: Secret scan (gitleaks) | |
| uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: OSV-Scanner | |
| uses: google/osv-scanner-action/osv-scanner-action@v2.3.8 | |
| continue-on-error: true | |
| with: | |
| scan-args: |- | |
| --lockfile=package-lock.json | |
| --format=sarif | |
| --output=osv.sarif | |
| - name: Upload OSV SARIF | |
| # `always()` so the SARIF still uploads even when the OSV-Scanner step | |
| # itself errors after writing the file (it runs continue-on-error). The | |
| # `hashFiles` guard covers the other path: when an earlier gate (e.g. the | |
| # audit) fails, OSV-Scanner is skipped and osv.sarif never exists — an | |
| # unguarded upload then adds a bogus second failure ("Path does not | |
| # exist: osv.sarif") that masks the real one. | |
| if: always() && hashFiles('osv.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: osv.sarif | |
| category: osv-scanner | |
| codeql: | |
| name: CodeQL (JS/TS static analysis) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: javascript-typescript | |
| - uses: github/codeql-action/analyze@v4 | |
| docker: | |
| name: Docker build + image scan (Trivy) | |
| runs-on: ubuntu-latest | |
| needs: [quality] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: docker/setup-buildx-action@v4 | |
| - uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: false | |
| load: true # load into the local daemon so Trivy can scan the built image | |
| tags: kaiban-distributed:ci-${{ github.sha }} | |
| # Blocking gate: fail the build on a FIXABLE CRITICAL/HIGH OS or library CVE | |
| # in the runtime image (unfixed base-image CVEs are reported but don't block). | |
| - name: Scan image (Trivy — gate on fixable CRITICAL/HIGH) | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: kaiban-distributed:ci-${{ github.sha }} | |
| format: table | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db | |
| # Always publish the full SARIF to the Security tab, even when the gate fails. | |
| - name: Scan image (Trivy — SARIF report) | |
| if: always() | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: kaiban-distributed:ci-${{ github.sha }} | |
| format: sarif | |
| output: trivy.sarif | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db | |
| - name: Upload Trivy SARIF to code scanning | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: trivy.sarif | |
| category: trivy-image |