ci(deps): bump the major-updates group across 1 directory with 7 updates #250

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '0 6 * * 1'

	jobs:
	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	permissions:
	contents: read
	pull-requests: write
	steps:
	- uses: actions/checkout@v6
	- uses: actions/dependency-review-action@v5
	with:
	fail-on-severity: high
	deny-licenses: GPL-3.0, AGPL-3.0

	trivy-filesystem:
	name: Trivy (Source)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	steps:
	- uses: actions/checkout@v6
	- uses: aquasecurity/trivy-action@master
	with:
	scan-type: fs
	scan-ref: .
	severity: CRITICAL,HIGH
	exit-code: '1'
	ignore-unfixed: true
	format: sarif
	output: trivy-results.sarif
	# Without this, trivy-action rewrites TRIVY_SEVERITY to
	# UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL whenever format=sarif, so
	# any MEDIUM/LOW finding also breaks the build via exit-code.
	limit-severities-for-sarif: true
	- uses: github/codeql-action/upload-sarif@v4
	if: always()
	with:
	sarif_file: trivy-results.sarif

Navigation Menu