chore(deps-dev): bump esbuild from 0.27.7 to 0.28.1 in /plugins/orchestr8 in the npm_and_yarn group across 1 directory #70
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Run weekly on Monday at 9am UTC | |
| - cron: "0 9 * * 1" | |
| workflow_dispatch: | |
| # Minimal permissions - jobs override as needed | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | |
| with: | |
| node-version: "18" | |
| - name: Install dependencies | |
| run: | | |
| cd plugins/orchestr8 | |
| npm install | |
| - name: Run npm audit (fail on high/critical) | |
| run: | | |
| cd plugins/orchestr8 | |
| npm audit --audit-level=high | |
| - name: Generate detailed audit report | |
| if: always() | |
| run: | | |
| cd plugins/orchestr8 | |
| npm audit --json > audit-report.json || true | |
| npm audit --audit-level=moderate > audit-report.txt || true | |
| - name: Upload audit report | |
| if: always() | |
| uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0 | |
| with: | |
| name: security-audit-report-${{ github.sha }} | |
| path: | | |
| plugins/orchestr8/audit-report.json | |
| plugins/orchestr8/audit-report.txt | |
| retention-days: 90 | |
| - name: Check for outdated dependencies | |
| run: | | |
| cd plugins/orchestr8 | |
| npm outdated || true | |
| secret-scanning: | |
| name: Secret Detection | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@44c470ffc35caa8b1eb3e8012ca53c2f9bea4eb5 # v2.3.6 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| - name: Verify no secrets in code | |
| run: | | |
| echo "Scanning for common secret patterns..." | |
| # Exclude test files and mock data | |
| if grep -r -E "(api_key|apikey|api-key|secret|password|bearer|token).*[:=].*['\"][A-Za-z0-9+/]{20,}['\"]" \ | |
| --include="*.js" \ | |
| --include="*.json" \ | |
| --exclude-dir=node_modules \ | |
| --exclude-dir=test \ | |
| --exclude-dir=tests \ | |
| --exclude="*test*.js" \ | |
| --exclude="*mock*.js" \ | |
| .; then | |
| echo "❌ Potential secrets detected in code" | |
| exit 1 | |
| else | |
| echo "✅ No hardcoded secrets detected" | |
| fi | |
| codeql-analysis: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # Required to upload CodeQL results | |
| actions: read # Required for CodeQL to analyze workflows | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 | |
| with: | |
| languages: javascript | |
| queries: +security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 | |
| with: | |
| category: "/language:javascript" | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.4.0 | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: runtime | |
| security-scorecard: | |
| name: OpenSSF Scorecard | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # Required to upload SARIF results | |
| id-token: write # Required to publish results | |
| actions: read # Required for Scorecard analysis | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - name: Run OpenSSF Scorecard | |
| uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload to code-scanning | |
| uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 | |
| with: | |
| sarif_file: results.sarif | |
| malware-scan: | |
| name: Malware Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | |
| with: | |
| node-version: "18" | |
| - name: Install dependencies | |
| run: | | |
| cd plugins/orchestr8 | |
| npm install | |
| - name: Scan for malicious packages | |
| run: | | |
| cd plugins/orchestr8 | |
| npx socket security | |
| continue-on-error: true | |
| security-summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [dependency-audit, secret-scanning, codeql-analysis] | |
| if: always() | |
| steps: | |
| - name: Download audit reports | |
| uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8 | |
| with: | |
| name: security-audit-report-${{ github.sha }} | |
| path: ./reports | |
| continue-on-error: true | |
| - name: Generate security summary | |
| run: | | |
| echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dependency Audit**: ${{ needs.dependency-audit.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Secret Scanning**: ${{ needs.secret-scanning.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **CodeQL Analysis**: ${{ needs.codeql-analysis.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [ -f "./reports/audit-report.txt" ]; then | |
| echo "### NPM Audit Details" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| head -n 50 ./reports/audit-report.txt >> $GITHUB_STEP_SUMMARY || true | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "📊 Full reports available in workflow artifacts" >> $GITHUB_STEP_SUMMARY | |
| - name: Check overall status | |
| if: needs.dependency-audit.result == 'failure' || needs.secret-scanning.result == 'failure' || needs.codeql-analysis.result == 'failure' | |
| run: | | |
| echo "❌ Security checks failed" | |
| exit 1 |