mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-11-13 15:51:00 +00:00
Maurice
84df69c18a
The server build runs out of memory in tsc with the grouped updates. Back to the previous dependencies until the update that causes it is found.
89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
name: Security Scan
|
|
|
|
# Neither job is a required check. What they report depends on the advisory
|
|
# databases as much as on the change: a CVE published overnight would turn
|
|
# every open PR red at once, including the ones that cannot fix it. The
|
|
# security floors that hold the fixes live in the root package.json's
|
|
# overrides, which a regenerated lockfile keeps.
|
|
#
|
|
# - npm-audit reads the lockfile only, so it runs in seconds on every PR
|
|
# and push into dev and main. It audits what the image installs (the
|
|
# server and shared workspaces without dev dependencies) and the
|
|
# standalone plugin-sdk.
|
|
# - scout scans the built image, base image packages included. It needs
|
|
# the Docker Hub login, so it runs on PRs and pushes into main only and
|
|
# skips fork PRs. Whether the image builds at all is test.yml's
|
|
# docker-image job, which a red scan cannot hide.
|
|
on:
|
|
pull_request:
|
|
branches: [main, dev]
|
|
push:
|
|
branches: [main, dev]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
npm-audit:
|
|
name: npm audit
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
# The client's dependencies end up in a browser bundle, not in the
|
|
# image, and are audited by hand until maplibre-gl's fix (a major) lands.
|
|
- name: Audit the image's runtime dependencies
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high --workspace=server --workspace=shared
|
|
|
|
- name: Audit trek-plugin-sdk
|
|
working-directory: plugin-sdk
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high
|
|
|
|
scout:
|
|
# Docker Hub secrets are not exposed to pull requests from forks, so the
|
|
# Scout login can never succeed there.
|
|
if: >-
|
|
github.repository == 'liketrek/TREK'
|
|
&& github.event.pull_request.head.repo.fork != true
|
|
&& (github.base_ref == 'main' || github.ref == 'refs/heads/main')
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: trek:scan
|
|
|
|
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
|
|
with:
|
|
command: cves
|
|
image: trek:scan
|
|
only-severities: critical,high
|
|
only-fixed: true
|
|
exit-code: true
|