Add Vercel project support and Blob-based span export #78
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| pull_request: | |
| merge_group: | |
| push: | |
| branches: | |
| - main | |
| schedule: | |
| - cron: "0 4 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-audit: | |
| name: pnpm audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| with: | |
| version: 11.7.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Audit production dependencies | |
| run: pnpm audit --prod --audit-level high | |
| - name: Audit dev dependencies | |
| run: pnpm audit --dev --audit-level critical | |
| - name: Verify package registry signatures | |
| run: pnpm audit signatures | |
| dependency-review: | |
| name: dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Review dependency changes | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: runtime | |
| license-check: true | |
| allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC | |
| allow-dependencies-licenses: >- | |
| pkg:npm/jackspeak@3.4.3, | |
| pkg:npm/lodash.includes@4.3.0, | |
| pkg:npm/lodash.isinteger@4.0.4, | |
| pkg:npm/lodash.isplainobject@4.0.6, | |
| pkg:npm/lodash.once@4.1.1, | |
| pkg:npm/lru-cache@11.5.1, | |
| pkg:npm/minipass@7.1.3, | |
| pkg:npm/package-json-from-dist@1.0.1, | |
| pkg:npm/path-scurry@1.11.1 | |
| codeql: | |
| name: codeql | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| with: | |
| languages: javascript-typescript | |
| queries: +security-extended,security-and-quality | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| secrets: | |
| name: gitleaks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Scan for secrets | |
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Required for GitHub organization repos using Gitleaks Action. | |
| # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| workflow-lint: | |
| name: workflow lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run actionlint | |
| run: docker run --rm -v "$PWD":/repo -w /repo rhysd/actionlint:1.7.12 .github/workflows/*.yml | |
| - name: Install zizmor | |
| run: python3 -m pip install --user zizmor==1.26.1 | |
| - name: Run zizmor | |
| run: ~/.local/bin/zizmor --min-severity=medium --format sarif .github/workflows > zizmor.sarif | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload zizmor SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| with: | |
| sarif_file: zizmor.sarif | |
| category: zizmor | |
| semgrep: | |
| name: semgrep | |
| if: github.event_name != 'pull_request' && github.event_name != 'merge_group' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Semgrep | |
| run: python3 -m pip install --user semgrep==1.168.0 | |
| - name: Semgrep scan | |
| run: ~/.local/bin/semgrep scan --config=auto --sarif --output=semgrep.sarif --error . | |
| - name: Upload Semgrep SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| with: | |
| sarif_file: semgrep.sarif | |
| category: semgrep | |
| trivy-fs: | |
| name: trivy filesystem | |
| if: github.event_name != 'pull_request' && github.event_name != 'merge_group' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| vuln-type: os,library | |
| severity: CRITICAL,HIGH | |
| exit-code: "1" | |
| format: sarif | |
| output: trivy.sarif | |
| - name: Upload Trivy SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| with: | |
| sarif_file: trivy.sarif | |
| category: trivy | |
| scorecard: | |
| name: openssf scorecard | |
| if: github.event_name != 'pull_request' && github.event_name != 'merge_group' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run Scorecard | |
| uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 | |
| with: | |
| results_format: sarif | |
| results_file: scorecard.sarif | |
| publish_results: true | |
| - name: Upload Scorecard SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| with: | |
| sarif_file: scorecard.sarif | |
| category: scorecard | |
| sbom: | |
| name: cyclonedx sbom | |
| if: github.event_name != 'pull_request' && github.event_name != 'merge_group' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| with: | |
| version: 11.7.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Generate CycloneDX SBOM | |
| run: pnpm dlx @cyclonedx/cyclonedx-npm@5.0.0 --ignore-npm-errors --output-file bom.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: cyclonedx-sbom | |
| path: bom.json | |
| if-no-files-found: error |