chore(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 in /agent #7293
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 6 * * 1' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| PNPM_VERSION: '10.34.5' | |
| GO_VERSION: '1.26.6' | |
| # Least-privilege default; the SARIF-uploading job opts into | |
| # security-events: write per-job below. | |
| permissions: | |
| contents: read | |
| jobs: | |
| npm-audit: | |
| name: NPM Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| with: | |
| version: ${{ env.PNPM_VERSION }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | |
| with: | |
| node-version-file: .node-version | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Install osv-scanner | |
| run: bash scripts/security/install-osv-scanner.sh | |
| - name: Run dependency audit | |
| run: bash scripts/security/check-npm-audit.sh | |
| go-vuln: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| # Runs before Setup Go on purpose: this job only proves the toolchain it | |
| # was handed is clean, so a pin that drifts anywhere else (release.yml | |
| # builds the shipped binary) would scan one Go and ship another. | |
| - name: Check Go toolchain pins agree | |
| run: bash scripts/security/check-go-version-pins.sh | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache-dependency-path: agent/go.sum | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| # Allowlist wrapper: fails on any symbol-level finding not in | |
| # scripts/security/govulncheck-allowlist.txt (reviewed, unfixable-only | |
| # exceptions with code-level mitigations). | |
| - name: Run govulncheck | |
| run: bash scripts/security/run-govulncheck.sh | |
| cargo-audit: | |
| name: Cargo Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| toolchain: stable | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Audit helper Cargo dependencies | |
| working-directory: apps/helper/src-tauri | |
| run: cargo audit --deny warnings | |
| - name: Audit viewer Cargo dependencies | |
| working-directory: apps/viewer/src-tauri | |
| run: cargo audit --deny warnings | |
| trivy-fs-scan: | |
| name: Trivy Filesystem Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Generate Trivy filesystem SARIF | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: 'fs' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'sarif' | |
| output: 'trivy-fs.sarif' | |
| exit-code: '0' | |
| - name: Upload Trivy filesystem SARIF | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-fs.sarif' | |
| - name: Generate Trivy filesystem SBOM | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: 'fs' | |
| format: 'cyclonedx' | |
| output: 'trivy-fs.cdx.json' | |
| exit-code: '0' | |
| - name: Upload Trivy filesystem SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: always() | |
| with: | |
| name: trivy-fs-sbom | |
| path: trivy-fs.cdx.json | |
| retention-days: 30 | |
| - name: Run blocking Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: 'fs' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| trivy-image-scan: | |
| name: Trivy Image Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Build API image | |
| run: docker build -f docker/Dockerfile.api -t breeze-api:security-scan . | |
| - name: Build Web image | |
| run: docker build -f docker/Dockerfile.web -t breeze-web:security-scan . | |
| - name: Build Portal image | |
| run: docker build -f apps/portal/Dockerfile -t breeze-portal:security-scan . | |
| - name: Build M365 Graph Read Executor image | |
| run: docker build -f apps/m365-graph-read-executor/Dockerfile -t breeze-m365-graph-read-executor:security-scan . | |
| - name: Build M365 Graph Actions Executor image | |
| run: docker build -f apps/m365-graph-actions-executor/Dockerfile -t breeze-m365-graph-actions-executor:security-scan . | |
| - name: Build M365 Communications Executor image | |
| run: docker build -f apps/m365-communications-executor/Dockerfile -t breeze-m365-communications-executor:security-scan . | |
| - name: Scan API image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'breeze-api:security-scan' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| - name: Scan Web image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'breeze-web:security-scan' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| - name: Scan Portal image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'breeze-portal:security-scan' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| - name: Scan M365 Graph Read Executor image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'breeze-m365-graph-read-executor:security-scan' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| - name: Scan M365 Graph Actions Executor image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'breeze-m365-graph-actions-executor:security-scan' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| - name: Scan M365 Communications Executor image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'breeze-m365-communications-executor:security-scan' | |
| severity: 'HIGH,CRITICAL' | |
| format: 'table' | |
| exit-code: '1' | |
| # Lints the workflow files themselves. actionlint catches real workflow | |
| # bugs (bad expressions, wrong action inputs, invalid syntax); shellcheck | |
| # integration is disabled because the existing style nits in release.yml | |
| # would make this job perma-red — red must mean "act now". zizmor audits | |
| # for security smells (template injection, unpinned third-party actions, | |
| # excessive permissions); pin policy + accepted findings live in | |
| # .github/zizmor.yml. | |
| workflow-lint: | |
| name: Workflow Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7; temporary resolver input; Task 2 pins it before push | |
| with: | |
| node-version-file: .node-version | |
| - name: Run workflow security policy | |
| run: | | |
| node --test \ | |
| .github/scripts/check-workflow-security.test.mjs \ | |
| scripts/security/pin-github-actions.test.mjs | |
| node .github/scripts/check-workflow-security.mjs | |
| - name: Install actionlint (pinned + checksum-verified) | |
| run: | | |
| curl -sSfL -o actionlint.tar.gz \ | |
| https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz | |
| echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 actionlint.tar.gz" | sha256sum -c - | |
| tar xzf actionlint.tar.gz actionlint | |
| - name: Run actionlint | |
| run: ./actionlint -shellcheck= | |
| # selfhost-signing-template/ is the source of truth for the public | |
| # breeze-selfhost-signing template repo. Its own .github/workflows/ci.yml | |
| # is never loaded here (nested workflow directories are not scanned), so | |
| # without this the verifier that decides whether a self-hoster applies | |
| # their Authenticode/Apple certificate to downloaded bytes is only ever | |
| # tested in the CONSUMER's fork, after adoption. | |
| - name: Verify BYO-signing template (self-test + standalone actionlint) | |
| run: | | |
| set -euo pipefail | |
| node selfhost-signing-template/scripts/verify-manifest.test.mjs | |
| # Lint the template as the standalone repo it becomes: its local | |
| # reusable-workflow refs (./.github/workflows/sign-release.yml) only | |
| # resolve when the template directory IS the repo root. | |
| standalone="$(mktemp -d)" | |
| cp -R selfhost-signing-template/. "$standalone/" | |
| # actionlint locates the workflows directory via the git root. | |
| git -C "$standalone" init -q | |
| (cd "$standalone" && "$GITHUB_WORKSPACE/actionlint" -shellcheck=) | |
| rm -rf "$standalone" | |
| - name: Run zizmor | |
| run: pipx run zizmor==1.25.2 --no-progress --config .github/zizmor.yml --min-severity medium .github/workflows/ |