mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-24 04:07:16 +00:00
rcourtman
c7c42f87e4
Build and Test audits npm dependencies on every push, but nothing scans the Go module for known vulnerabilities and neither surface is re-checked when no pushes happen — which is exactly when a newly disclosed advisory against unchanged code goes unnoticed. Run govulncheck and both npm audits weekly on a schedule so a failed run emails the maintainer.
61 lines
1.9 KiB
YAML
61 lines
1.9 KiB
YAML
name: Security Scan
|
|
|
|
# Build and Test audits dependencies on every push, but a quiet week with no
|
|
# pushes means no run — and newly disclosed vulnerabilities land against
|
|
# unchanged code. This schedule is the backstop: it re-scans the Go module
|
|
# (which has no push-time vulnerability gate at all) and the frontend
|
|
# dependency graph against the current advisory databases. A failed scheduled
|
|
# run emails the repository owner.
|
|
on:
|
|
schedule:
|
|
- cron: '30 5 * * 1' # weekly, Monday 05:30 UTC, before the 06:00 triage run
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
govulncheck:
|
|
name: Go Vulnerability Scan
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version-file: go.mod
|
|
|
|
- name: Install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
|
|
|
|
- name: Scan Go module for reachable vulnerabilities
|
|
run: govulncheck ./...
|
|
|
|
npm-audit:
|
|
name: Frontend Dependency Audit
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: '20'
|
|
cache: npm
|
|
cache-dependency-path: frontend-modern/package-lock.json
|
|
|
|
- name: Install frontend dependencies
|
|
working-directory: frontend-modern
|
|
run: npm ci
|
|
|
|
- name: Audit complete frontend dependency graph
|
|
working-directory: frontend-modern
|
|
run: npm audit
|
|
|
|
- name: Audit production frontend dependencies
|
|
working-directory: frontend-modern
|
|
run: npm audit --omit=dev
|