@networkpro/web 1.23.0 → 1.24.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/build-and-publish.yml +3 -3
- package/.github/workflows/lighthouse.yml +1 -1
- package/.github/workflows/meta-check.yml +1 -1
- package/.github/workflows/publish-test.yml +3 -3
- package/.github/workflows/secret-scan.yml +105 -0
- package/.github/workflows/templates/publish.template.yml +3 -3
- package/.node-version +1 -1
- package/.nvmrc +1 -1
- package/CHANGELOG.md +43 -1
- package/package.json +5 -5
|
@@ -38,7 +38,7 @@ jobs:
|
|
|
38
38
|
- name: Set up Node.js
|
|
39
39
|
uses: actions/setup-node@v6
|
|
40
40
|
with:
|
|
41
|
-
node-version:
|
|
41
|
+
node-version: 24
|
|
42
42
|
cache: npm
|
|
43
43
|
cache-dependency-path: package-lock.json
|
|
44
44
|
|
|
@@ -123,7 +123,7 @@ jobs:
|
|
|
123
123
|
- name: Set up Node.js for npmjs
|
|
124
124
|
uses: actions/setup-node@v6
|
|
125
125
|
with:
|
|
126
|
-
node-version:
|
|
126
|
+
node-version: 24
|
|
127
127
|
registry-url: https://registry.npmjs.org/
|
|
128
128
|
cache: npm
|
|
129
129
|
cache-dependency-path: package-lock.json
|
|
@@ -184,7 +184,7 @@ jobs:
|
|
|
184
184
|
- name: Set up Node.js for GPR
|
|
185
185
|
uses: actions/setup-node@v6
|
|
186
186
|
with:
|
|
187
|
-
node-version:
|
|
187
|
+
node-version: 24
|
|
188
188
|
registry-url: https://npm.pkg.github.com/
|
|
189
189
|
cache: npm
|
|
190
190
|
cache-dependency-path: package-lock.json
|
|
@@ -36,7 +36,7 @@ jobs:
|
|
|
36
36
|
- name: Set up Node.js
|
|
37
37
|
uses: actions/setup-node@v6
|
|
38
38
|
with:
|
|
39
|
-
node-version:
|
|
39
|
+
node-version: 24
|
|
40
40
|
cache: npm
|
|
41
41
|
cache-dependency-path: package-lock.json
|
|
42
42
|
|
|
@@ -121,7 +121,7 @@ jobs:
|
|
|
121
121
|
- name: Set up Node.js for npmjs
|
|
122
122
|
uses: actions/setup-node@v6
|
|
123
123
|
with:
|
|
124
|
-
node-version:
|
|
124
|
+
node-version: 24
|
|
125
125
|
registry-url: https://registry.npmjs.org/
|
|
126
126
|
cache: npm
|
|
127
127
|
cache-dependency-path: package-lock.json
|
|
@@ -182,7 +182,7 @@ jobs:
|
|
|
182
182
|
- name: Set up Node.js for GPR
|
|
183
183
|
uses: actions/setup-node@v6
|
|
184
184
|
with:
|
|
185
|
-
node-version:
|
|
185
|
+
node-version: 24
|
|
186
186
|
registry-url: https://npm.pkg.github.com/
|
|
187
187
|
cache: npm
|
|
188
188
|
cache-dependency-path: package-lock.json
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
# .github/workflows/secret-scan.yml
|
|
2
|
+
#
|
|
3
|
+
# Copyright © 2025 Network Pro Strategies (Network Pro™)
|
|
4
|
+
# SPDX-License-Identifier: CC-BY-4.0 OR GPL-3.0-or-later
|
|
5
|
+
# This file is part of Network Pro
|
|
6
|
+
|
|
7
|
+
name: Secret Scan (Gitleaks)
|
|
8
|
+
|
|
9
|
+
on:
|
|
10
|
+
pull_request:
|
|
11
|
+
schedule:
|
|
12
|
+
- cron: '0 8 * * *' # nightly scan at 8 AM UTC
|
|
13
|
+
workflow_dispatch:
|
|
14
|
+
|
|
15
|
+
jobs:
|
|
16
|
+
gitleaks-scan:
|
|
17
|
+
runs-on: ubuntu-24.04
|
|
18
|
+
permissions:
|
|
19
|
+
contents: read
|
|
20
|
+
security-events: write
|
|
21
|
+
steps:
|
|
22
|
+
# ---------------------------------------------------------------------
|
|
23
|
+
# Checkout the full repo history (needed for Gitleaks to scan all commits)
|
|
24
|
+
# ---------------------------------------------------------------------
|
|
25
|
+
- uses: actions/checkout@v5
|
|
26
|
+
with:
|
|
27
|
+
fetch-depth: 0
|
|
28
|
+
|
|
29
|
+
# ---------------------------------------------------------------------
|
|
30
|
+
# Run Gitleaks scan
|
|
31
|
+
# Uses org license key (safe because GitHub never passes secrets to forks)
|
|
32
|
+
# ---------------------------------------------------------------------
|
|
33
|
+
- name: Run Gitleaks scan
|
|
34
|
+
id: gitleaks
|
|
35
|
+
uses: gitleaks/gitleaks-action@v2
|
|
36
|
+
env:
|
|
37
|
+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
38
|
+
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
|
|
39
|
+
GITLEAKS_REPORT_PATH: gitleaks-report.json
|
|
40
|
+
|
|
41
|
+
# ---------------------------------------------------------------------
|
|
42
|
+
# LAYER 2: Secret-handling / fork guard
|
|
43
|
+
# Upload artifact only if workflow runs in trusted context
|
|
44
|
+
# (either not a PR, or a PR from the same repo)
|
|
45
|
+
# ---------------------------------------------------------------------
|
|
46
|
+
- name: Upload Gitleaks Report
|
|
47
|
+
if: always() && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request')
|
|
48
|
+
uses: actions/upload-artifact@v4
|
|
49
|
+
with:
|
|
50
|
+
name: gitleaks-report
|
|
51
|
+
path: gitleaks-report.json
|
|
52
|
+
|
|
53
|
+
# ---------------------------------------------------------------------
|
|
54
|
+
# LAYER 1: Output redaction
|
|
55
|
+
# Public-safe summary – shows only secret descriptions, hides file paths.
|
|
56
|
+
# ---------------------------------------------------------------------
|
|
57
|
+
- name: Post Gitleaks summary
|
|
58
|
+
if: always()
|
|
59
|
+
run: |
|
|
60
|
+
echo "### 🧩 Gitleaks Scan Summary" >> $GITHUB_STEP_SUMMARY
|
|
61
|
+
if [ -s gitleaks-report.json ]; then
|
|
62
|
+
count=$(jq '.findings | length' gitleaks-report.json)
|
|
63
|
+
if [ "$count" -gt 0 ]; then
|
|
64
|
+
echo "🚨 **$count potential secret$( [ "$count" -ne 1 ] && echo "s" ) detected!**" >> $GITHUB_STEP_SUMMARY
|
|
65
|
+
echo "" >> $GITHUB_STEP_SUMMARY
|
|
66
|
+
# 🔒 Redacted output: no file paths or secret values
|
|
67
|
+
jq -r '.findings[] | "- \(.Description) (at undisclosed path)"' gitleaks-report.json | head -n 10 >> $GITHUB_STEP_SUMMARY
|
|
68
|
+
echo "" >> $GITHUB_STEP_SUMMARY
|
|
69
|
+
echo "_Full report available in Artifacts section (maintainers only)._ " >> $GITHUB_STEP_SUMMARY
|
|
70
|
+
else
|
|
71
|
+
echo "✅ No secrets detected." >> $GITHUB_STEP_SUMMARY
|
|
72
|
+
fi
|
|
73
|
+
else
|
|
74
|
+
echo "⚠️ No report file found." >> $GITHUB_STEP_SUMMARY
|
|
75
|
+
fi
|
|
76
|
+
|
|
77
|
+
# ---------------------------------------------------------------------
|
|
78
|
+
# LAYER 2: Secret-handling / fork guard
|
|
79
|
+
# Create issue only in trusted repo context (avoids using tokens on forks)
|
|
80
|
+
# ---------------------------------------------------------------------
|
|
81
|
+
- name: Create issue for detected secrets
|
|
82
|
+
if: failure() && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request')
|
|
83
|
+
uses: actions/github-script@v7
|
|
84
|
+
with:
|
|
85
|
+
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
86
|
+
script: |
|
|
87
|
+
const issueTitle = `🚨 Secret(s) detected in ${context.repo.repo}`;
|
|
88
|
+
const issueBody = `Gitleaks found potential secrets in commit ${context.sha}.\n\nCheck workflow logs and artifacts for details.`;
|
|
89
|
+
await github.rest.issues.create({
|
|
90
|
+
owner: context.repo.owner,
|
|
91
|
+
repo: context.repo.repo,
|
|
92
|
+
title: issueTitle,
|
|
93
|
+
body: issueBody,
|
|
94
|
+
labels: ['security', 'gitleaks']
|
|
95
|
+
});
|
|
96
|
+
|
|
97
|
+
# ---------------------------------------------------------------------
|
|
98
|
+
# LAYER 2: Secret-handling / fork guard
|
|
99
|
+
# Send ntfy alert only for trusted repo context.
|
|
100
|
+
# ---------------------------------------------------------------------
|
|
101
|
+
- name: Send ntfy notification
|
|
102
|
+
if: failure() && (github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request')
|
|
103
|
+
run: |
|
|
104
|
+
curl -d "🚨 Gitleaks found secrets in repo: $GITHUB_REPOSITORY on commit $GITHUB_SHA" \
|
|
105
|
+
https://ntfy.neteng.pro/${{ secrets.NTFY_TOPIC }}
|
|
@@ -46,7 +46,7 @@ jobs:
|
|
|
46
46
|
- name: Set up Node.js
|
|
47
47
|
uses: actions/setup-node@v6
|
|
48
48
|
with:
|
|
49
|
-
node-version:
|
|
49
|
+
node-version: 24
|
|
50
50
|
cache: npm
|
|
51
51
|
cache-dependency-path: package-lock.json
|
|
52
52
|
|
|
@@ -131,7 +131,7 @@ jobs:
|
|
|
131
131
|
- name: Set up Node.js for npmjs
|
|
132
132
|
uses: actions/setup-node@v6
|
|
133
133
|
with:
|
|
134
|
-
node-version:
|
|
134
|
+
node-version: 24
|
|
135
135
|
registry-url: https://registry.npmjs.org/
|
|
136
136
|
cache: npm
|
|
137
137
|
cache-dependency-path: package-lock.json
|
|
@@ -192,7 +192,7 @@ jobs:
|
|
|
192
192
|
- name: Set up Node.js for GPR
|
|
193
193
|
uses: actions/setup-node@v6
|
|
194
194
|
with:
|
|
195
|
-
node-version:
|
|
195
|
+
node-version: 24
|
|
196
196
|
registry-url: https://npm.pkg.github.com/
|
|
197
197
|
cache: npm
|
|
198
198
|
cache-dependency-path: package-lock.json
|
package/.node-version
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
|
|
1
|
+
24.11.0
|
package/.nvmrc
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
|
|
1
|
+
24.11.0
|
package/CHANGELOG.md
CHANGED
|
@@ -22,6 +22,47 @@ This project attempts to follow [Keep a Changelog](https://keepachangelog.com/en
|
|
|
22
22
|
|
|
23
23
|
---
|
|
24
24
|
|
|
25
|
+
## [1.24.0]
|
|
26
|
+
|
|
27
|
+
### Added
|
|
28
|
+
|
|
29
|
+
- Introduced [GitLeaks](https://github.com/gitleaks/gitleaks-action) secret scan CI action as `.github/workflows/secret-scan.yml`.
|
|
30
|
+
- Introduced two-phase scan strategy:
|
|
31
|
+
- **Pull Request scans** to detect secrets before merge.
|
|
32
|
+
- **Nightly scheduled scans** (`cron: "0 4 * * *"`) for full-history coverage.
|
|
33
|
+
- Added **artifact upload** for the `gitleaks-report.json` file, allowing maintainers to download complete results from the Actions UI.
|
|
34
|
+
- Implemented **public-safe summary output** in `$GITHUB_STEP_SUMMARY`:
|
|
35
|
+
- Displays secret descriptions only.
|
|
36
|
+
- Redacts file paths and other sensitive details.
|
|
37
|
+
- Provides a concise, readable summary of findings.
|
|
38
|
+
- Added **GitHub Issue creation step** to automatically open a security issue when leaks are detected.
|
|
39
|
+
- Integrated optional **ntfy.sh notifications** for real-time alerting on secret leaks.
|
|
40
|
+
- Implemented **fork-safety guards** to prevent workflows triggered from untrusted forks from:
|
|
41
|
+
- Accessing organization secrets (license keys, ntfy topic).
|
|
42
|
+
- Uploading artifacts or creating issues.
|
|
43
|
+
- Added descriptive comments and logical layer separation:
|
|
44
|
+
- **Layer 1 – Output Redaction**
|
|
45
|
+
- **Layer 2 – Secret / Fork Handling**
|
|
46
|
+
|
|
47
|
+
### Changed
|
|
48
|
+
|
|
49
|
+
- Bumped project version to `v1.23.1`.
|
|
50
|
+
- Updated `.node-version` and `.nvmrc` to utilize **Node.js** `24.11.0` (LTS).
|
|
51
|
+
- Updated CI workflows to utilize `node-version: 24`:
|
|
52
|
+
- `build-and-publish.yml`
|
|
53
|
+
- `lighthouse.yml`
|
|
54
|
+
- `meta-check.yml`
|
|
55
|
+
- `playwright.yml`
|
|
56
|
+
- `publish-test.yml`
|
|
57
|
+
- `templates/publish.template.yml`
|
|
58
|
+
- Updated dependencies:
|
|
59
|
+
- `@eslint/js` `^9.38.0` → `^9.39.0`
|
|
60
|
+
- `eslint` `^9.38.0` → `^9.39.0`
|
|
61
|
+
- `globals` `^16.4.0` → `^16.5.0`
|
|
62
|
+
- `posthog-js` `^1.282.0` → `^1.284.0`
|
|
63
|
+
|
|
64
|
+
---
|
|
65
|
+
|
|
25
66
|
## [1.23.0] - 2025-10-30
|
|
26
67
|
|
|
27
68
|
### Documentation
|
|
@@ -1362,7 +1403,8 @@ This project attempts to follow [Keep a Changelog](https://keepachangelog.com/en
|
|
|
1362
1403
|
|
|
1363
1404
|
<!-- Link references -->
|
|
1364
1405
|
|
|
1365
|
-
[Unreleased]: https://github.com/netwk-pro/netwk-pro.github.io/compare/v1.
|
|
1406
|
+
[Unreleased]: https://github.com/netwk-pro/netwk-pro.github.io/compare/v1.24.0...HEAD
|
|
1407
|
+
[1.24.0]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.24.0
|
|
1366
1408
|
[1.23.0]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.23.0
|
|
1367
1409
|
[1.22.2]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.22.2
|
|
1368
1410
|
[1.22.1]: https://github.com/netwk-pro/netwk-pro.github.io/releases/tag/v1.22.1
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@networkpro/web",
|
|
3
3
|
"private": false,
|
|
4
|
-
"version": "1.
|
|
4
|
+
"version": "1.24.0",
|
|
5
5
|
"description": "Locking Down Networks, Unlocking Confidence™ | Security, Networking, Privacy — Network Pro Strategies",
|
|
6
6
|
"keywords": [
|
|
7
7
|
"advisory",
|
|
@@ -79,13 +79,13 @@
|
|
|
79
79
|
},
|
|
80
80
|
"dependencies": {
|
|
81
81
|
"dompurify": "^3.3.0",
|
|
82
|
-
"posthog-js": "^1.
|
|
82
|
+
"posthog-js": "^1.284.0",
|
|
83
83
|
"semver": "^7.7.3",
|
|
84
84
|
"svelte": "5.43.2"
|
|
85
85
|
},
|
|
86
86
|
"devDependencies": {
|
|
87
87
|
"@eslint/compat": "^1.4.1",
|
|
88
|
-
"@eslint/js": "^9.
|
|
88
|
+
"@eslint/js": "^9.39.0",
|
|
89
89
|
"@lhci/cli": "^0.15.1",
|
|
90
90
|
"@playwright/test": "^1.56.1",
|
|
91
91
|
"@sveltejs/adapter-vercel": "^6.1.1",
|
|
@@ -96,11 +96,11 @@
|
|
|
96
96
|
"@vitest/coverage-v8": "3.2.4",
|
|
97
97
|
"autoprefixer": "^10.4.21",
|
|
98
98
|
"browserslist": "^4.27.0",
|
|
99
|
-
"eslint": "^9.
|
|
99
|
+
"eslint": "^9.39.0",
|
|
100
100
|
"eslint-config-prettier": "^10.1.8",
|
|
101
101
|
"eslint-plugin-jsdoc": "^61.1.11",
|
|
102
102
|
"eslint-plugin-svelte": "^3.13.0",
|
|
103
|
-
"globals": "^16.
|
|
103
|
+
"globals": "^16.5.0",
|
|
104
104
|
"jsdom": "26.1.0",
|
|
105
105
|
"lightningcss": "^1.30.2",
|
|
106
106
|
"markdownlint": "^0.39.0",
|