mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-10 22:31:01 +00:00
Maurice
61378559ca
- sharp 0.35.5 (librsvg CVE), with the musl pins that ship in the image. - follow-redirects 1.16.2, postcss-selector-parser 6.1.5 and serialize-javascript 7.1.3, from the open advisories. - GitHub Actions: github-script 9 and the minor-and-patch group. - plugin-sdk: @types/update-notifier 6.0.9. The grouped npm update is left out: with it the server build runs out of memory in tsc, and the culprit is not found yet.
89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
name: Security Scan
|
|
|
|
# Neither job is a required check. What they report depends on the advisory
|
|
# databases as much as on the change: a CVE published overnight would turn
|
|
# every open PR red at once, including the ones that cannot fix it. The
|
|
# security floors that hold the fixes live in the root package.json's
|
|
# overrides, which a regenerated lockfile keeps.
|
|
#
|
|
# - npm-audit reads the lockfile only, so it runs in seconds on every PR
|
|
# and push into dev and main. It audits what the image installs (the
|
|
# server and shared workspaces without dev dependencies) and the
|
|
# standalone plugin-sdk.
|
|
# - scout scans the built image, base image packages included. It needs
|
|
# the Docker Hub login, so it runs on PRs and pushes into main only and
|
|
# skips fork PRs. Whether the image builds at all is test.yml's
|
|
# docker-image job, which a red scan cannot hide.
|
|
on:
|
|
pull_request:
|
|
branches: [main, dev]
|
|
push:
|
|
branches: [main, dev]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
npm-audit:
|
|
name: npm audit
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
# The client's dependencies end up in a browser bundle, not in the
|
|
# image, and are audited by hand until maplibre-gl's fix (a major) lands.
|
|
- name: Audit the image's runtime dependencies
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high --workspace=server --workspace=shared
|
|
|
|
- name: Audit trek-plugin-sdk
|
|
working-directory: plugin-sdk
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high
|
|
|
|
scout:
|
|
# Docker Hub secrets are not exposed to pull requests from forks, so the
|
|
# Scout login can never succeed there.
|
|
if: >-
|
|
github.repository == 'liketrek/TREK'
|
|
&& github.event.pull_request.head.repo.fork != true
|
|
&& (github.base_ref == 'main' || github.ref == 'refs/heads/main')
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: trek:scan
|
|
|
|
- uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- uses: docker/scout-action@e7e2a72bf1485d10a58f30696b6c513b261ce4fa # v1.29.0
|
|
with:
|
|
command: cves
|
|
image: trek:scan
|
|
only-severities: critical,high
|
|
only-fixed: true
|
|
exit-code: true
|