mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 21:46:49 +00:00
Maurice
4cfe6b59ba
security.yml, lint-prettier.yml and the release workflows still ran actions built for Node 20 (checkout and setup-node v4, github-script v7, the docker actions v3/v5, create-github-app-token v1), which GitHub now forces onto Node 24 with a deprecation warning on every run. They move to the Node 24 majors test.yml already uses (download-artifact to v7, since v6 is still Node 20). Third-party actions, several of which hold the Docker Hub and GitHub App secrets, are pinned by commit with the tag in a comment. ubuntu-latest moves to a new Ubuntu release on 10-19, so every job names ubuntu-24.04 and the switch happens in a PR. Every setup-node reads .nvmrc; publish-plugin-sdk leaves 22, which it ran under a comment claiming it matched the server. security.yml gains an npm audit job over the lockfile, on PRs and pushes into dev as well as main. It covers what the image installs and the plugin SDK, takes seconds, and would have flagged the brace-expansion regression the ORM squash brought in the day it landed. Scout keeps its image scan on main. Neither becomes a required check: a CVE published overnight would turn every open PR red, including the ones that cannot fix it. The scout job now also skips PRs into dev, which the trigger change would otherwise hand it. .github/dependabot.yml adds weekly version updates into dev for the root workspace, plugin-sdk, the actions and the Docker base images, minor and patch grouped per ecosystem, majors one PR each. The Node major in the Dockerfile is left to a hand-made change together with .nvmrc.
89 lines
3.0 KiB
YAML
89 lines
3.0 KiB
YAML
name: Security Scan
|
|
|
|
# Neither job is a required check. What they report depends on the advisory
|
|
# databases as much as on the change: a CVE published overnight would turn
|
|
# every open PR red at once, including the ones that cannot fix it. The
|
|
# security floors that hold the fixes live in the root package.json's
|
|
# overrides, which a regenerated lockfile keeps.
|
|
#
|
|
# - npm-audit reads the lockfile only, so it runs in seconds on every PR
|
|
# and push into dev and main. It audits what the image installs (the
|
|
# server and shared workspaces without dev dependencies) and the
|
|
# standalone plugin-sdk.
|
|
# - scout scans the built image, base image packages included. It needs
|
|
# the Docker Hub login, so it runs on PRs and pushes into main only and
|
|
# skips fork PRs. Whether the image builds at all is test.yml's
|
|
# docker-image job, which a red scan cannot hide.
|
|
on:
|
|
pull_request:
|
|
branches: [main, dev]
|
|
push:
|
|
branches: [main, dev]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
npm-audit:
|
|
name: npm audit
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: .nvmrc
|
|
|
|
# The client's dependencies end up in a browser bundle, not in the
|
|
# image, and are audited by hand until maplibre-gl's fix (a major) lands.
|
|
- name: Audit the image's runtime dependencies
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high --workspace=server --workspace=shared
|
|
|
|
- name: Audit trek-plugin-sdk
|
|
working-directory: plugin-sdk
|
|
run: npm audit --package-lock-only --omit=dev --audit-level=high
|
|
|
|
scout:
|
|
# Docker Hub secrets are not exposed to pull requests from forks, so the
|
|
# Scout login can never succeed there.
|
|
if: >-
|
|
github.repository == 'liketrek/TREK'
|
|
&& github.event.pull_request.head.repo.fork != true
|
|
&& (github.base_ref == 'main' || github.ref == 'refs/heads/main')
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
|
|
- uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: trek:scan
|
|
|
|
- uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- uses: docker/scout-action@221e7f4860634eeb1579e3bd7ca232e577bd1864 # v1.26.0
|
|
with:
|
|
command: cves
|
|
image: trek:scan
|
|
only-severities: critical,high
|
|
only-fixed: true
|
|
exit-code: true
|