mirror of
https://github.com/zyycn/codex-proxy-rs.git
synced 2026-11-06 08:06:19 +00:00
ZyyandCodex
b9bcb4e086
Share binary builds and dependency caches, run Windows platform checks in parallel, and reuse verified CI evidence for version-only releases. Reuse prebuilt CI image inputs and add read-only release preflight. Co-authored-by: Codex <noreply@openai.com>
85 lines
2.3 KiB
YAML
85 lines
2.3 KiB
YAML
name: Security
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
ref:
|
|
description: Exact commit SHA to audit
|
|
required: true
|
|
type: string
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: '0 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: security-${{ github.workflow }}-${{ inputs.ref || github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
backend-security:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Install cargo-audit
|
|
uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
|
|
with:
|
|
tool: cargo-audit@0.22.2
|
|
fallback: none
|
|
|
|
- name: Run Cargo audits
|
|
run: |
|
|
cargo-audit audit --file backend/Cargo.lock
|
|
|
|
frontend-security:
|
|
runs-on: ubuntu-26.04
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
|
|
with:
|
|
package_json_file: frontend/package.json
|
|
|
|
- name: Read build toolchains
|
|
id: toolchains
|
|
run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Setup Node
|
|
uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
|
with:
|
|
node-version: ${{ steps.toolchains.outputs.node }}
|
|
cache: pnpm
|
|
cache-dependency-path: frontend/pnpm-lock.yaml
|
|
|
|
- name: Install frontend dependencies
|
|
run: pnpm --dir frontend install --frozen-lockfile
|
|
|
|
- name: Run pnpm audit
|
|
run: pnpm --dir frontend audit --prod --audit-level=high
|
|
|
|
container-security:
|
|
if: github.event_name == 'schedule'
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
uses: ./.github/workflows/_container.yml
|
|
with:
|
|
ref: ${{ github.sha }}
|