build(deps-dev): bump postcss from 8.5.25 to 8.5.26 in /frontend #614
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Checks | |
| on: | |
| schedule: | |
| - cron: '0 3 * * 1' # weekly on Mondays UTC | |
| workflow_dispatch: {} | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: javascript-typescript, python | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| gitleaks: | |
| name: Secret Scan (Gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| dependency-and-audit: | |
| name: Dependency & Runtime Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "24.15.0" | |
| cache: npm | |
| - name: Node audit (blocking high/critical) | |
| working-directory: ./ | |
| run: | | |
| npm ci | |
| echo "Blocking security gate: fail PR/main on npm high or critical advisories." | |
| npm audit --audit-level=high | |
| if [ -f frontend/package-lock.json ]; then | |
| cd frontend | |
| npm ci | |
| npm audit --audit-level=high | |
| fi | |
| - name: Python pip-audit (blocking advisory audit) | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install pip-audit | |
| echo "Blocking security gate where pip-audit can verify installed Python dependency advisories." | |
| pip-audit -r backend/python/requirements.txt | |
| - name: Cargo audit (blocking) | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config | |
| echo "Blocking security gate: cargo-audit installation and advisory findings must both succeed." | |
| cargo install --locked cargo-audit --version 0.22.2 | |
| cd backend/rust | |
| cargo audit |