Security #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Re-scan weekly so newly-disclosed CVEs against unchanged | |
| # dependencies get caught even when nothing in the repo changed. | |
| - cron: "17 6 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| osv-scanner: | |
| name: OSV-Scanner (Cargo + npm) | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c51854704019a247608d928f370c98740469d4b5 # v2.3.5 | |
| with: | |
| scan-args: |- | |
| --lockfile=Cargo.lock | |
| --lockfile=pnpm-lock.yaml | |
| upload-sarif: true | |
| cargo-deny: | |
| name: cargo-deny (advisories · licenses · sources · bans) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v2.0.17 | |
| with: | |
| command: check advisories licenses sources bans | |
| zizmor: | |
| name: zizmor (GitHub Actions static analysis) | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| # continue-on-error: existing workflows have findings that are out of | |
| # scope for this PR (tracked in #1404). zizmor still uploads SARIF to | |
| # the Security tab so findings are visible; flip to blocking once the | |
| # cleanup issue lands. | |
| - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3 | |
| continue-on-error: true |