feat(security): add dependency vulnerability scanning and auto-update… #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Scan | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| pull_request: | |
| schedule: | |
| # Run every Monday at 08:00 UTC | |
| - cron: "0 8 * * 1" | |
| workflow_dispatch: | |
| jobs: | |
| audit: | |
| name: Audit & Auto-update Dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Run vulnerability audit | |
| run: pnpm run audit:scan | |
| continue-on-error: false | |
| - name: Upload audit report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: audit-report | |
| path: audit-report.json | |
| retention-days: 30 | |
| auto-update: | |
| name: Auto-update Dependencies (scheduled) | |
| runs-on: ubuntu-latest | |
| # Only run on schedule or manual trigger, not on PRs | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Apply non-breaking security patches | |
| run: pnpm run audit:fix | |
| continue-on-error: true | |
| - name: Check for changes | |
| id: changes | |
| run: | | |
| if git diff --quiet; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Open PR with security patches | |
| if: steps.changes.outputs.changed == 'true' | |
| uses: peter-evans/create-pull-request@v6 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: "chore(deps): apply security patches" | |
| branch: chore/auto-security-patches | |
| title: "chore(deps): automated security dependency updates" | |
| body: | | |
| This PR was automatically generated by the Dependency Vulnerability Scan workflow. | |
| **What changed:** Non-breaking security patches were applied via `pnpm audit --fix`. | |
| **Review checklist:** | |
| - [ ] Verify updated packages in `pnpm-lock.yaml` | |
| - [ ] Confirm tests still pass | |
| - [ ] Check for any breaking changes in updated packages | |
| labels: | | |
| dependencies | |
| security | |
| draft: false |