mirror of
https://github.com/semgrep/skills.git
synced 2026-09-20 14:21:26 +08:00
Drew Dennison
1932e6d984
- Upgrade actions/setup-node v4 → v6 - Upgrade actions/checkout v4 → v6 - Upgrade actions/upload-artifact v4 → v7 - Bump unist-util-visit 5.0.0 → 5.1.0 - Bump @types/node 20.19.29 → 25.0.10 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
name: Security Audit
|
|
|
|
on:
|
|
schedule:
|
|
# Run weekly on Mondays at 9:00 UTC
|
|
- cron: '0 9 * * 1'
|
|
push:
|
|
paths:
|
|
- '**/pnpm-lock.yaml'
|
|
- '**/package.json'
|
|
pull_request:
|
|
paths:
|
|
- '**/pnpm-lock.yaml'
|
|
- '**/package.json'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
audit:
|
|
name: Dependency Audit
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: '20'
|
|
cache: 'pnpm'
|
|
cache-dependency-path: packages/skill-build/pnpm-lock.yaml
|
|
|
|
- name: Install dependencies
|
|
run: make install
|
|
|
|
- name: Run security audit
|
|
working-directory: packages/skill-build
|
|
run: pnpm audit --audit-level=moderate
|
|
continue-on-error: true
|
|
|
|
- name: Check for outdated dependencies
|
|
working-directory: packages/skill-build
|
|
run: |
|
|
echo "## Outdated Dependencies" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
|
pnpm outdated || true
|
|
pnpm outdated >> $GITHUB_STEP_SUMMARY 2>&1 || echo "All dependencies are up to date" >> $GITHUB_STEP_SUMMARY
|
|
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
|
|
|