@taraxvoid/voidflow 0.13.1 → 0.14.0-next.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -0
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -179,6 +179,38 @@ jobs:
|
|
|
179
179
|
The job reports as `validate / Validate`, the check the `tool()` entry in
|
|
180
180
|
[`rulesets/index.ts`](#branch-rulesets-as-code) requires.
|
|
181
181
|
|
|
182
|
+
### Code scanning (SARIF)
|
|
183
|
+
|
|
184
|
+
`site-ci.yml` and `tool-ci.yml` write gitleaks and zizmor results as SARIF
|
|
185
|
+
and keep them as the `voidflow-sarif` artifact (7 days). gitleaks still fails
|
|
186
|
+
the job on a finding; the zizmor SARIF run scans every workflow and never
|
|
187
|
+
fails the job (the zizmor gate in `tool-ci.yml` is unchanged). Both steps run
|
|
188
|
+
after a failure too, so the findings that failed a run are the ones uploaded.
|
|
189
|
+
|
|
190
|
+
`upload-sarif.yml` sends them to code scanning, which is what voidlight
|
|
191
|
+
counts. It is a separate workflow because it needs `security-events: write`,
|
|
192
|
+
and a reusable workflow can't ask for more than its caller grants: adding it to
|
|
193
|
+
the validate workflows would break every caller that doesn't. Add a second job:
|
|
194
|
+
|
|
195
|
+
```yaml
|
|
196
|
+
jobs:
|
|
197
|
+
validate:
|
|
198
|
+
uses: taraxvoid/voidflow/.github/workflows/site-ci.yml@<sha> # <version>
|
|
199
|
+
sarif:
|
|
200
|
+
needs: validate
|
|
201
|
+
if: ${{ !cancelled() && needs.validate.result != 'skipped' }}
|
|
202
|
+
permissions:
|
|
203
|
+
contents: read
|
|
204
|
+
actions: read
|
|
205
|
+
security-events: write
|
|
206
|
+
uses: taraxvoid/voidflow/.github/workflows/upload-sarif.yml@<sha> # <version>
|
|
207
|
+
```
|
|
208
|
+
|
|
209
|
+
Each tool uploads under its own category (`gitleaks`, `zizmor`), so a later
|
|
210
|
+
run closes only that tool's fixed alerts. gitleaks SARIF is redacted.
|
|
211
|
+
Code scanning is free on public repositories; private ones need GitHub Code
|
|
212
|
+
Security, without which the upload step fails.
|
|
213
|
+
|
|
182
214
|
### Unlighthouse (performance / SEO budgets)
|
|
183
215
|
|
|
184
216
|
`site-ci.yml` runs `bun run test:e2e:lighthouse` on PRs into `live`. Sites
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@taraxvoid/voidflow",
|
|
3
|
-
"version": "0.
|
|
4
|
-
"description": "
|
|
3
|
+
"version": "0.14.0-next.1",
|
|
4
|
+
"description": "Enter a flow state of security, stability, and developer ergonomics - batteries-included Biome, vitest, Astro, local hooks, CI and deployments on Netlify and Cloudflare support with GitHub rulesets, branch environments, releases and security checks.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"keywords": [
|
|
7
7
|
"github-actions",
|