Merge pull request #2399 from chaterm/dependabot/github_actions/truff… #2676

	name: Security Scan

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	# Dependency vulnerability audit
	dependency-audit:
	name: Dependency Audit
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Use Node.js 20.x
	uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
	with:
	node-version: 20.x

	- name: Install dependencies
	run: npm ci

	- name: Run npm audit
	run: npm audit --audit-level=high
	continue-on-error: true

	- name: Run npm audit (JSON output)
	run: npm audit --json > audit-report.json \|\| true

	- name: Upload audit report
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
	if: always()
	with:
	name: npm-audit-report
	path: audit-report.json
	retention-days: 30

	# Secrets and sensitive information detection
	secrets-scan:
	name: Secrets Detection
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	fetch-depth: 0 # Full history for better detection

	- name: Run Gitleaks
	uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Run TruffleHog (OSS)
	uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # main
	with:
	extra_args: --only-verified
	continue-on-error: true

Navigation Menu