Patryk-KuchtaandClaude Opus 5
ab7b2fa6f4
sharp 0.35.5 requires Node >=20.9.0, so the node:18-alpine image failed to load the linuxmusl-arm64 binary and the production build broke. Move the image and both CI workflows to Node 24 (current Active LTS), raise the engines floor to the version sharp actually needs, and declare packageManager to silence the corepack warning. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
74 lines
1.7 KiB
YAML
74 lines
1.7 KiB
YAML
name: Security Audit
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- master
|
|
- develop
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- master
|
|
- develop
|
|
schedule:
|
|
- cron: '0 0 * * 1'
|
|
|
|
jobs:
|
|
security-audit:
|
|
name: Security Vulnerability Scan
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10
|
|
|
|
- name: Get pnpm store directory
|
|
shell: bash
|
|
run: |
|
|
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
|
|
|
|
- name: Setup pnpm cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ${{ env.STORE_PATH }}
|
|
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pnpm-store-
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Run pnpm audit
|
|
run: pnpm audit --audit-level=moderate
|
|
continue-on-error: true
|
|
|
|
- name: Generate security report
|
|
run: pnpm run security:check
|
|
|
|
- name: Check for outdated dependencies
|
|
run: pnpm outdated || true
|
|
|
|
- name: Upload security report
|
|
uses: actions/upload-artifact@v3
|
|
if: always()
|
|
with:
|
|
name: security-report
|
|
path: security-report.json
|
|
retention-days: 30
|
|
|
|
- name: Notify on high/critical vulnerabilities
|
|
if: failure()
|
|
run: |
|
|
echo "::error::Security vulnerabilities detected! Check the security report artifact for details."
|