fix(ci): stabilize Windows tests, prod audit, and secret scan #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '17 3 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@a2983b8bed1923f44751c5c43237f479442827b3 # v3 | |
| with: | |
| languages: javascript-typescript | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@a2983b8bed1923f44751c5c43237f479442827b3 # v3 | |
| # actions/dependency-review-action requires the repository's Dependency | |
| # graph to be enabled (Settings > Code security and analysis). Until an | |
| # org admin enables it, newly introduced vulnerabilities are still gated | |
| # by the "npm run audit:prod" step in ci.yml. To restore this job: | |
| # | |
| # dependency-review: | |
| # name: Dependency review | |
| # if: github.event_name == 'pull_request' | |
| # runs-on: ubuntu-latest | |
| # steps: | |
| # - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| # - name: Review dependency changes | |
| # uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| secrets: | |
| name: Secret scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a GITLEAKS_LICENSE for organization | |
| # accounts. Run the open-source CLI directly instead so the scan stays | |
| # license-free while still covering full git history (fetch-depth: 0). | |
| - name: Scan repository history | |
| env: | |
| GITLEAKS_VERSION: "8.30.1" | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C "$RUNNER_TEMP" gitleaks | |
| "$RUNNER_TEMP/gitleaks" version | |
| "$RUNNER_TEMP/gitleaks" detect --source . --redact --no-banner --verbose |