mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 16:06:08 +00:00
79 lines
2.1 KiB
YAML
79 lines
2.1 KiB
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: '0 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
backend-security:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Install cargo-audit
|
|
uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
|
|
with:
|
|
tool: cargo-audit@0.22.2
|
|
fallback: none
|
|
|
|
- name: Run Cargo audits
|
|
run: |
|
|
cargo-audit audit --file backend/Cargo.lock
|
|
|
|
frontend-security:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
|
|
with:
|
|
package_json_file: frontend/package.json
|
|
|
|
- name: Read build toolchains
|
|
id: toolchains
|
|
run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
|
with:
|
|
node-version: ${{ steps.toolchains.outputs.node }}
|
|
cache: pnpm
|
|
cache-dependency-path: frontend/pnpm-lock.yaml
|
|
|
|
- name: Install frontend dependencies
|
|
run: pnpm --dir frontend install --frozen-lockfile
|
|
|
|
- name: Run pnpm audit
|
|
run: pnpm --dir frontend audit --prod --audit-level=high
|
|
|
|
container-security:
|
|
if: github.event_name == 'schedule'
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
uses: ./.github/workflows/_container.yml
|
|
with:
|
|
ref: ${{ github.sha }}
|