mirror of
https://github.com/chillpadclub/bedolaga-cabinet.git
synced 2026-07-28 09:33:46 +00:00
aa1ecbfdef
- .github/dependabot.yml: еженедельные обновления npm/github-actions/docker со сгруппированными PR - codeql.yml: SAST (javascript-typescript, security-and-quality) на push/PR в main/dev + еженедельный проход - security-audit.yml: npm audit --audit-level=high (пока non-blocking) - docker.yml: Trivy-скан запушенного образа с выгрузкой SARIF в Security tab (non-blocking), least-privilege permissions на workflow
36 lines
828 B
YAML
36 lines
828 B
YAML
name: Security Audit
|
||
|
||
on:
|
||
push:
|
||
branches: [main, dev]
|
||
pull_request:
|
||
branches: [main, dev]
|
||
schedule:
|
||
- cron: "27 4 * * 1"
|
||
|
||
permissions:
|
||
contents: read
|
||
|
||
jobs:
|
||
npm-audit:
|
||
name: npm audit
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout code
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Setup Node.js
|
||
uses: actions/setup-node@v4
|
||
with:
|
||
node-version: "20"
|
||
cache: "npm"
|
||
|
||
- name: Install dependencies
|
||
run: npm ci
|
||
|
||
# Пока non-blocking: сообщаем о HIGH/CRITICAL, но не валим пайплайн.
|
||
# Когда долги по зависимостям разгребём — убрать continue-on-error.
|
||
- name: Run npm audit (high+)
|
||
continue-on-error: true
|
||
run: npm audit --audit-level=high
|