fix: broken images across platform and cron context issue #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | ||
|
Check failure on line 1 in .github/workflows/security-scan.yml
|
||
| on: | ||
| push: | ||
| branches: [ master, main, develop ] | ||
| pull_request: | ||
| branches: [ '**' ] | ||
| schedule: | ||
| # Run daily at 2 AM UTC | ||
| - cron: '0 2 * * *' | ||
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| jobs: | ||
| security-scan: | ||
| name: Security Scanning | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| fetch-depth: 0 # Full history for secrets scanning | ||
| - name: Install pnpm | ||
| uses: pnpm/action-setup@v4 | ||
| with: | ||
| version: 10.12.1 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '20.x' | ||
| cache: 'pnpm' | ||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
| # Secrets Scanning | ||
| - name: Run Gitleaks (Secret Detection) | ||
| uses: gitleaks/gitleaks-action@v2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| continue-on-error: true | ||
| # Dependency Security Audit | ||
| - name: Run npm audit | ||
| run: | | ||
| echo "Running npm audit..." | ||
| pnpm audit --production --audit-level=moderate || true | ||
| echo "Audit completed" | ||
| continue-on-error: true | ||
| # Check for known vulnerabilities | ||
| # Note: Snyk scan is optional - add SNYK_TOKEN to repository secrets to enable | ||
| - name: Run Snyk Security Scan | ||
| if: ${{ github.event_name != 'pull_request' && secrets.SNYK_TOKEN != '' }} | ||
| uses: snyk/actions/node@master | ||
| continue-on-error: true | ||
| with: | ||
| args: --severity-threshold=high | ||
| snyk-token: ${{ secrets.SNYK_TOKEN }} | ||
| # Dependency Review (for PRs) | ||
| - name: Dependency Review | ||
| uses: actions/dependency-review-action@v4 | ||
| if: github.event_name == 'pull_request' | ||
| continue-on-error: true | ||
| # Check for hardcoded secrets in code | ||
| - name: Check for hardcoded secrets | ||
| run: | | ||
| echo "Checking for potential hardcoded secrets..." | ||
| # Check for common secret patterns | ||
| if grep -rE "(password|secret|token|api[_-]?key|apikey)\s*=\s*['\"][^'\"]+['\"]" --include="*.ts" --include="*.js" --exclude-dir=node_modules --exclude-dir=dist .; then | ||
| echo "⚠️ Warning: Potential hardcoded secrets found" | ||
| exit 1 | ||
| fi | ||
| continue-on-error: true | ||
| # Security Summary | ||
| - name: Security Summary | ||
| run: | | ||
| echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY | ||
| echo "- ✅ Secrets scanning completed" >> $GITHUB_STEP_SUMMARY | ||
| echo "- ✅ Dependency audit completed" >> $GITHUB_STEP_SUMMARY | ||
| echo "- ✅ Code security checks completed" >> $GITHUB_STEP_SUMMARY | ||
