Use mapped countryCode for flag URL #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| push: | |
| branches: [ "main", "master" ] | |
| pull_request: | |
| branches: [ "main", "master" ] | |
| schedule: | |
| # Run every day at 2:00 AM UTC | |
| - cron: '0 2 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| # Scan for secrets accidentally committed | |
| secret-scan: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| fetch-depth: 0 | |
| - name: TruffleHog OSS | |
| uses: trufflesecurity/trufflehog@6bd2d14f7a4bc1e569fa3550efa7ec632a4fa67b | |
| with: | |
| path: ./ | |
| base: ${{ github.event.before }} | |
| head: ${{ github.sha }} | |
| extra_args: --debug --only-verified | |
| continue-on-error: true | |
| # Scan .NET dependencies for known vulnerabilities | |
| dotnet-security: | |
| name: .NET Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - name: List vulnerable packages | |
| run: dotnet list Jellyfin.Plugin.JellyfinEnhanced/JellyfinEnhanced.csproj package --vulnerable --include-transitive 2>&1 | tee vulnerable-packages.txt | |
| - name: Check for vulnerabilities | |
| run: | | |
| if grep -q "has the following vulnerable packages" vulnerable-packages.txt; then | |
| echo "::error::Vulnerable packages found!" | |
| cat vulnerable-packages.txt | |
| exit 1 | |
| else | |
| echo "No vulnerable packages found." | |
| fi | |
| # SARIF upload for GitHub Security tab | |
| upload-sarif: | |
| name: Upload SARIF Results | |
| runs-on: ubuntu-latest | |
| needs: [secret-scan, dotnet-security] | |
| if: always() | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Create summary | |
| run: | | |
| echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "All security scans completed. Check individual job results for details." >> $GITHUB_STEP_SUMMARY |