Add a weekly scheduled dependency vulnerability scan

Build and Test audits npm dependencies on every push, but nothing scans the Go module for known vulnerabilities and neither surface is re-checked when no pushes happen — which is exactly when a newly disclosed advisory against unchanged code goes unnoticed. Run govulncheck and both npm audits weekly on a schedule so a failed run emails the maintainer.
2026-09-10 02:25:56 +00:00 · 2026-08-23 14:40:01 +01:00
parent a7f87471f4
commit c7c42f87e4
1 changed files with 60 additions and 0 deletions
@@ -0,0 +1,60 @@
+name: Security Scan
+
+# Build and Test audits dependencies on every push, but a quiet week with no
+# pushes means no run — and newly disclosed vulnerabilities land against
+# unchanged code. This schedule is the backstop: it re-scans the Go module
+# (which has no push-time vulnerability gate at all) and the frontend
+# dependency graph against the current advisory databases. A failed scheduled
+# run emails the repository owner.
+on:
+  schedule:
+    - cron: '30 5 * * 1' # weekly, Monday 05:30 UTC, before the 06:00 triage run
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: Go Vulnerability Scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+
+      - name: Scan Go module for reachable vulnerabilities
+        run: govulncheck ./...
+
+  npm-audit:
+    name: Frontend Dependency Audit
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: frontend-modern/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend-modern
+        run: npm ci
+
+      - name: Audit complete frontend dependency graph
+        working-directory: frontend-modern
+        run: npm audit
+
+      - name: Audit production frontend dependencies
+        working-directory: frontend-modern
+        run: npm audit --omit=dev