mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
efcc06d50b
* ci: harden CI and supply-chain pipeline * Add frontend Vitest step to ci.yml so the 241 existing frontend tests run on every PR (mirrors the backend build/test/lint/audit order). * Pin Node 26 as a single source of truth: new .node-version, node-version-file on all setup-node calls, engines.node ">=26.0.0" in all three package.json files. Matches the Dockerfile's node:26-alpine. * SHA-pin remaining mutable actions in the start-app composite (actions/setup-node v6, actions/cache v4.3.0). * Pin Dockerfile supply-chain inputs: golang:1.26.3-alpine by sha256 digest in both builder stages; replace mutable-tag git clone with commit-SHA fetch for docker/cli (v29.4.1) and docker/compose (v5.1.3). LDFLAGS version strings and otel patch preserved unchanged. * Ref-scope docker-publish concurrency so two different release tags cannot cancel each other; same-ref reruns still cancel as before. * Harden CLA workflow: drop actions:write from permissions; tighten the issue_comment trigger to PRs only (github.event.issue.pull_request != null) matching the two documented CLA phrases. No PR code is checked out. * Drop trivy-version: latest from both Trivy scans so the SHA-pinned aquasecurity/trivy-action governs the bundled binary version. The HIGH/CRITICAL gate, severity filter, and trivy.yaml (OpenVEX) are unchanged. * Restructure Dependabot: add applies-to: security-updates groups for npm (root/backend/frontend), docker, and github-actions; switch github-actions to directories so the local composite action is monitored alongside the top-level workflows. * Add a daily scheduled SARIF security scan (security-scan.yml): two parallel jobs scanning saelix/sencho:latest and a fresh main HEAD build, uploading to GitHub code scanning. Least-privilege (contents: read, security-events: write). Visibility only; existing PR-blocking and release-blocking Trivy gates are not weakened. Validation: backend tsc clean; frontend tsc clean; frontend npm test 27 files / 241 tests pass; npm audit --audit-level=high passes at root, backend, and frontend; docker buildx build --check passes with no warnings (all pinned digests resolve from the registry). * ci(frontend): set explicit jsdom URL so localStorage initializes in CI jsdom does not instantiate window.localStorage / sessionStorage when the document has the opaque about:blank origin. Five frontend test files that call localStorage.clear() in beforeEach started failing once the new frontend Vitest step in this PR began running them on Linux CI runners. Configuring environmentOptions.jsdom.url with a real same-origin URL is the documented Vitest 4.x workaround and is a config-only change. All 27 test files (241 tests) pass locally with the fix applied.
105 lines
3.8 KiB
YAML
105 lines
3.8 KiB
YAML
name: Scheduled Security Scan
|
|
|
|
# Visibility-only re-scan of the published image and a fresh build of main.
|
|
# Surfaces CVEs disclosed between releases by uploading SARIF to GitHub Code
|
|
# Scanning. The PR-blocking gate in ci.yml and the release-blocking gate in
|
|
# docker-publish.yml are unchanged; this workflow only writes findings.
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * *' # Daily 00:00 UTC
|
|
workflow_dispatch:
|
|
|
|
# Prevent overlap when a manual workflow_dispatch fires while the daily cron
|
|
# run is still in flight. cancel-in-progress is safe here: the workflow only
|
|
# uploads SARIF for visibility and has no side effects on the registry.
|
|
concurrency:
|
|
group: security-scan
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
scan-published:
|
|
name: Trivy SARIF (published :latest)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
steps:
|
|
- name: Checkout (trivy.yaml + VEX)
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
# Same SHA-pinned action used by the PR-blocking and release-blocking
|
|
# scans. The trivy binary version is whatever this action SHA bundles;
|
|
# Dependabot's all-actions group moves it forward when the action is
|
|
# bumped, keeping a single source of truth.
|
|
- name: Trivy scan of saelix/sencho:latest
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: saelix/sencho:latest
|
|
format: sarif
|
|
output: trivy-published.sarif
|
|
severity: 'CRITICAL,HIGH,MEDIUM'
|
|
trivy-config: trivy.yaml
|
|
ignore-unfixed: false
|
|
|
|
# if: always() so findings still upload when trivy itself failed mid-run
|
|
# (e.g. CVE DB pull timeout). The categorical separation from the
|
|
# scan-main job below keeps the two result sets distinct in the UI.
|
|
- name: Upload SARIF to code scanning
|
|
if: always()
|
|
uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
|
|
with:
|
|
sarif_file: trivy-published.sarif
|
|
category: trivy-published-image
|
|
|
|
scan-main:
|
|
name: Trivy SARIF (main HEAD build)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 25
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
|
|
|
|
# Mirrors the daily-cache-bust logic from ci.yml / docker-publish.yml so
|
|
# the apk upgrade layer rebuilds at least once per calendar day.
|
|
- name: Compute daily apk cache bust value
|
|
id: apk-bust
|
|
run: echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build image from main HEAD
|
|
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: localhost/sencho:scheduled-scan
|
|
cache-from: type=gha
|
|
build-args: |
|
|
APK_CACHE_BUST=${{ steps.apk-bust.outputs.date }}
|
|
|
|
- name: Trivy scan of fresh main build
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: localhost/sencho:scheduled-scan
|
|
format: sarif
|
|
output: trivy-main.sarif
|
|
severity: 'CRITICAL,HIGH,MEDIUM'
|
|
trivy-config: trivy.yaml
|
|
ignore-unfixed: false
|
|
|
|
- name: Upload SARIF to code scanning
|
|
if: always()
|
|
uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
|
|
with:
|
|
sarif_file: trivy-main.sarif
|
|
category: trivy-main-head
|