build: 升级依赖并更新前端资源文件 #87
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================= | |
| # MindX Security Scanning Pipeline | |
| # ============================================================================= | |
| # Runs on: push to main, all PRs (schedule optional) | |
| # | |
| # Includes: | |
| # - CodeQL (SAST) — GitHub's native static analysis | |
| # - Dependency Review — checks for vulnerable dependencies | |
| # - govulncheck — Go-specific vulnerability scanner | |
| # ============================================================================= | |
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - '**.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - '**.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| schedule: | |
| # Run weekly on Monday 00:00 UTC | |
| - cron: '0 0 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| env: | |
| GO_VERSION: '1.26' | |
| CGO_ENABLED: 1 | |
| jobs: | |
| # ========================================================================== | |
| # CodeQL — Static Application Security Testing (SAST) | |
| # ========================================================================== | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [go] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - name: Set up Go (for CodeQL autobuild) | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: '/language:${{ matrix.language }}' | |
| # ========================================================================== | |
| # Dependency Review — check for vulnerabilities in go.mod/go.sum | |
| # NOTE: Only runs on PRs (requires base_ref/head_ref from PR context) | |
| # ========================================================================== | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: moderate | |
| # ========================================================================== | |
| # govulncheck — Go vulnerability database check | |
| # ========================================================================== | |
| govulncheck: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck | |
| run: | | |
| PKGS=$(go list ./... | grep -v 'gort\|onnxruntime\|tree-sitter' || true) | |
| if [ -z "$PKGS" ]; then | |
| echo "No packages to scan" | |
| else | |
| govulncheck $PKGS | tee govulncheck-output.txt | |
| fi | |
| - name: Upload govulncheck report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: govulncheck-report | |
| path: govulncheck-output.txt | |
| retention-days: 14 | |
| # ========================================================================== | |
| # Summary — aggregate results ( informational only) | |
| # ========================================================================== | |
| summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [codeql, dependency-review, govulncheck] | |
| if: always() | |
| steps: | |
| - name: Security scan summary | |
| run: | | |
| echo "## 🔒 Security Scan Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Check | Status |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| CodeQL SAST | ${{ needs.codeql.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Dependency Review | ${{ needs.dependency-review.result == 'success' && '✅ Passed' || needs.dependency-review.result == 'skipped' && '⏭️ Skipped (PR only)' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| govulncheck | ${{ needs.govulncheck.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY" |