34 lines
1.2 KiB
YAML
34 lines
1.2 KiB
YAML
name: Frontend security
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- '**'
|
|
pull_request:
|
|
schedule:
|
|
- cron: '17 5 * * *'
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Record checked revision
|
|
run: git rev-parse HEAD
|
|
- name: Scan history with Gitleaks 8.30.1
|
|
run: |
|
|
curl --fail --location --silent --show-error https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
|
|
echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb /tmp/gitleaks.tar.gz' | sha256sum --check
|
|
mkdir -p /tmp/gitleaks-bin
|
|
tar -xzf /tmp/gitleaks.tar.gz -C /tmp/gitleaks-bin gitleaks
|
|
/tmp/gitleaks-bin/gitleaks git --log-opts=--all --redact=100 --no-banner
|
|
- uses: https://github.com/actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Verify pre-commit secret blocking and redaction
|
|
run: PATH=/tmp/gitleaks-bin:$PATH node --test scripts/test-pre-commit.mjs
|
|
- name: Audit runtime and development dependencies
|
|
run: npm audit --include=dev --audit-level=low
|