Patryk-KuchtaandClaude Opus 5
9c597cbc80
pnpm/action-setup's self-installer fails on Node 24 ("Running
self-installer..." exits 1), breaking both workflows. Use corepack
instead, which picks up the pnpm version from the packageManager field
and matches how the Dockerfile installs it.
Also move upload-artifact to v4, since v3 is retired.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
72 lines
1.7 KiB
YAML
72 lines
1.7 KiB
YAML
name: Security Audit
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- master
|
|
- develop
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- master
|
|
- develop
|
|
schedule:
|
|
- cron: '0 0 * * 1'
|
|
|
|
jobs:
|
|
security-audit:
|
|
name: Security Vulnerability Scan
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
|
|
- name: Setup pnpm
|
|
run: corepack enable
|
|
|
|
- name: Get pnpm store directory
|
|
shell: bash
|
|
run: |
|
|
echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
|
|
|
|
- name: Setup pnpm cache
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ${{ env.STORE_PATH }}
|
|
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pnpm-store-
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Run pnpm audit
|
|
run: pnpm audit --audit-level=moderate
|
|
continue-on-error: true
|
|
|
|
- name: Generate security report
|
|
run: pnpm run security:check
|
|
|
|
- name: Check for outdated dependencies
|
|
run: pnpm outdated || true
|
|
|
|
- name: Upload security report
|
|
uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: security-report
|
|
path: security-report.json
|
|
retention-days: 30
|
|
|
|
- name: Notify on high/critical vulnerabilities
|
|
if: failure()
|
|
run: |
|
|
echo "::error::Security vulnerabilities detected! Check the security report artifact for details."
|