mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-13 15:51:00 +00:00
dependabot[bot]
2fde123e87
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
name: Security Scan
|
|
|
|
# Neither job is a required check. What they report depends on the advisory
|
|
# databases as much as on the change: a CVE published overnight would turn
|
|
# every open PR red at once, including the ones that cannot fix it. The
|
|
# security floors that hold the fixes live in the root package.json's
|
|
# overrides, which a regenerated lockfile keeps.
|
|
#
|
|
# - npm-audit reads the lockfile only, so it runs in seconds on every PR
|
|
# and push into dev and main. It audits what the image installs (the
|
|
# server and shared workspaces without dev dependencies) and the
|
|
# standalone plugin-sdk.
|
|
# - scout scans the built image, base image packages included. It needs
|
|
# the Docker Hub login, so it runs on PRs and pushes into main only and
|
|
# skips fork PRs. Whether the image builds at all is test.yml's
|
|
# docker-image job, which a red scan cannot hide.
|
|
on:
|
|
pull_request:
|
|
branches: [main, dev]
|
|
push:
|
|
branches: [main, dev]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
npm-audit:
|
|
name: npm audit
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
# The client's dependencies end up in a browser bundle, not in the
|
|
# image, and are audited by hand until maplibre-gl's fix (a major) lands.
|
|
- name: Audit the image's runtime dependencies
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high --workspace=server --workspace=shared
|
|
|
|
- name: Audit trek-plugin-sdk
|
|
working-directory: plugin-sdk
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high
|
|
|
|
scout:
|
|
# Docker Hub secrets are not exposed to pull requests from forks, so the
|
|
# Scout login can never succeed there.
|
|
if: >-
|
|
github.repository == 'liketrek/TREK'
|
|
&& github.event.pull_request.head.repo.fork != true
|
|
&& (github.base_ref == 'main' || github.ref == 'refs/heads/main')
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: trek:scan
|
|
|
|
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
|
|
with:
|
|
command: cves
|
|
image: trek:scan
|
|
only-severities: critical,high
|
|
only-fixed: true
|
|
exit-code: true
|