chore(release): v0.9.40 #245
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security | |
| on: | |
| pull_request: | |
| branches: [master, main] | |
| push: | |
| branches: [master, main] | |
| schedule: | |
| - cron: '11 6 * * 1' | |
| jobs: | |
| semgrep: | |
| name: semgrep | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| container: | |
| image: semgrep/semgrep | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - run: | | |
| semgrep scan --error --severity ERROR \ | |
| --config p/javascript \ | |
| --config p/typescript \ | |
| --config p/owasp-top-ten \ | |
| --config p/secrets | |
| npm-audit: | |
| name: dependency audit | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| - name: Audit dependencies | |
| run: | | |
| if [ -f package.json ]; then | |
| # Full production report for visibility (never fails the build). | |
| pnpm audit --prod || true | |
| echo "::group::Gate" | |
| # Gate on CRITICAL only. Auditing the live advisory DB at "high" | |
| # flaps daily on transitive build/test-tooling CVEs that don't reach | |
| # users; real shipping high+ vulns are patched via pnpm.overrides. | |
| # Criticals are rare and genuinely block-worthy. | |
| pnpm audit --prod --audit-level critical | |
| echo "::endgroup::" | |
| else | |
| echo "no package.json — skipping audit" | |
| fi | |
| gitleaks: | |
| name: gitleaks | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| VERSION=8.21.2 | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Scan history | |
| run: gitleaks detect --source . --redact --verbose --no-banner --exit-code 1 |