mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 08:06:19 +00:00
dependabot[bot]andCodex
81c58b1cdc
Update the pinned setup-node action to 7.0.0 across quality and security workflows. Co-authored-by: Codex <noreply@openai.com>
80 lines
2.1 KiB
YAML
80 lines
2.1 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: '0 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: security-scan-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
backend-security:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Setup Rust
|
|
uses: dtolnay/rust-toolchain@1a3a6d54512beeaffd394f8d516ca16f2c506a20 # 1.97
|
|
|
|
- name: Cache Rust
|
|
uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
|
|
with:
|
|
workspaces: backend -> target
|
|
|
|
- name: Install cargo-audit
|
|
run: cargo install cargo-audit --version 0.22.2 --locked
|
|
|
|
- name: Run cargo audit
|
|
working-directory: backend
|
|
run: cargo audit
|
|
|
|
frontend-security:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
|
|
with:
|
|
version: 11.7.0
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
cache-dependency-path: frontend/pnpm-lock.yaml
|
|
|
|
- name: Install frontend dependencies
|
|
run: pnpm --dir frontend install --frozen-lockfile
|
|
|
|
- name: Run pnpm audit
|
|
run: pnpm --dir frontend audit --prod --audit-level=high
|
|
|
|
container-security:
|
|
if: github.event_name == 'schedule'
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
uses: ./.github/workflows/_container.yml
|
|
with:
|
|
ref: ${{ github.sha }}
|