@tehw0lf/yaft 0.0.8 → 0.0.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
# Security Monitoring Workflow
|
|
2
|
+
#
|
|
3
|
+
# This workflow performs security scanning using only the security-specific
|
|
4
|
+
# reusable workflows, without building or publishing.
|
|
5
|
+
#
|
|
6
|
+
# Schedule: Runs daily at 2:00 AM UTC to catch newly disclosed vulnerabilities
|
|
7
|
+
# Manual Trigger: Can be triggered via GitHub Actions UI or gh CLI
|
|
8
|
+
#
|
|
9
|
+
# Security Checks:
|
|
10
|
+
# - Source code scanning: Semgrep (OWASP Top 10, security-audit, CI), npm audit
|
|
11
|
+
# - Artifact scanning: Trivy on dist/ artifacts (requires prior build)
|
|
12
|
+
#
|
|
13
|
+
name: Security Monitoring
|
|
14
|
+
|
|
15
|
+
on:
|
|
16
|
+
schedule:
|
|
17
|
+
# Run daily at 2:00 AM UTC
|
|
18
|
+
- cron: "0 2 * * *"
|
|
19
|
+
workflow_dispatch:
|
|
20
|
+
# Allow manual triggering
|
|
21
|
+
|
|
22
|
+
permissions:
|
|
23
|
+
contents: read
|
|
24
|
+
security-events: write
|
|
25
|
+
actions: read
|
|
26
|
+
pull-requests: write
|
|
27
|
+
|
|
28
|
+
jobs:
|
|
29
|
+
# Scan source code for security vulnerabilities
|
|
30
|
+
scan_source:
|
|
31
|
+
name: Scan Source Code
|
|
32
|
+
uses: tehw0lf/workflows/.github/workflows/security-scan-source.yml@main
|
|
33
|
+
permissions:
|
|
34
|
+
contents: write
|
|
35
|
+
security-events: write
|
|
36
|
+
actions: read
|
|
37
|
+
pull-requests: write
|
|
38
|
+
with:
|
|
39
|
+
tool: "npm"
|
|
40
|
+
semgrep_rules: "auto p/security-audit p/owasp-top-ten p/ci p/nodejs p/typescript"
|
|
41
|
+
npm_audit_omit_dev: true
|
|
42
|
+
npm_audit_severity_threshold: "high"
|
|
43
|
+
|
|
44
|
+
# Download artifacts from latest CI build
|
|
45
|
+
# Note: Reuses artifacts from the main CI workflow instead of rebuilding
|
|
46
|
+
download_artifacts:
|
|
47
|
+
name: Download Build Artifacts
|
|
48
|
+
runs-on: ubuntu-latest
|
|
49
|
+
needs: scan_source
|
|
50
|
+
if: always()
|
|
51
|
+
|
|
52
|
+
steps:
|
|
53
|
+
- name: Download latest dist artifacts from CI
|
|
54
|
+
uses: dawidd6/action-download-artifact@v6
|
|
55
|
+
with:
|
|
56
|
+
workflow: build.yml
|
|
57
|
+
name: dist
|
|
58
|
+
path: dist/
|
|
59
|
+
if_no_artifact_found: warn
|
|
60
|
+
|
|
61
|
+
- name: Upload artifacts for scanning
|
|
62
|
+
if: hashFiles('dist/**/*') != ''
|
|
63
|
+
uses: actions/upload-artifact@v4
|
|
64
|
+
with:
|
|
65
|
+
name: dist
|
|
66
|
+
path: dist/
|
|
67
|
+
retention-days: 1
|
|
68
|
+
|
|
69
|
+
# Scan built artifacts for vulnerabilities
|
|
70
|
+
scan_artifacts:
|
|
71
|
+
name: Scan Artifacts
|
|
72
|
+
needs: download_artifacts
|
|
73
|
+
if: needs.download_artifacts.result == 'success'
|
|
74
|
+
uses: tehw0lf/workflows/.github/workflows/security-scan-artifacts.yml@main
|
|
75
|
+
permissions:
|
|
76
|
+
contents: read
|
|
77
|
+
security-events: write
|
|
78
|
+
actions: read
|
|
79
|
+
with:
|
|
80
|
+
tool: "npm"
|
|
81
|
+
artifact_path: "dist"
|