mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 08:06:19 +00:00
ZyyandCodex
8fb42300c1
Reuse test binaries and frontend builds, reduce redundant cache writes, and overlap release preparation with quality checks. Protect skills, contribution rules, and GitHub configuration, and simplify workflow names. Co-authored-by: Codex <noreply@openai.com>
80 lines
2.1 KiB
YAML
80 lines
2.1 KiB
YAML
name: Security
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: '0 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
backend-security:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Setup Rust
|
|
uses: dtolnay/rust-toolchain@1a3a6d54512beeaffd394f8d516ca16f2c506a20 # 1.97
|
|
|
|
- name: Cache Rust
|
|
uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
|
|
with:
|
|
workspaces: backend -> target
|
|
|
|
- name: Install cargo-audit
|
|
run: cargo install cargo-audit --version 0.22.2 --locked
|
|
|
|
- name: Run Cargo audits
|
|
run: |
|
|
cargo audit --file backend/Cargo.lock
|
|
|
|
frontend-security:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
|
|
with:
|
|
package_json_file: frontend/package.json
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 24
|
|
cache: pnpm
|
|
cache-dependency-path: frontend/pnpm-lock.yaml
|
|
|
|
- name: Install frontend dependencies
|
|
run: pnpm --dir frontend install --frozen-lockfile
|
|
|
|
- name: Run pnpm audit
|
|
run: pnpm --dir frontend audit --prod --audit-level=high
|
|
|
|
container-security:
|
|
if: github.event_name == 'schedule'
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
uses: ./.github/workflows/_container.yml
|
|
with:
|
|
ref: ${{ github.sha }}
|