Git workflow, environments & CI/CD pipeline (#1)

2026-07-01 11:44:34 +02:00
parent 8c2e52ad60
commit ae8e6b672e
16 changed files with 566 additions and 16 deletions
@@ -0,0 +1,54 @@
+name: Security
+
+# Scans run alongside CI on every PR and on pushes to the long-lived branches.
+# This is the DETECTIVE layer (backstop). The PREVENTIVE layer is the local
+# pre-commit hook — this catches anything that slipped past it (e.g. --no-verify)
+# and scans the full history, not just the staged diff.
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+
+jobs:
+  secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0            # full history so gitleaks scans every commit
+      - name: Secret scan (gitleaks)
+        # Run the binary directly — the container-mode runner has no Docker socket,
+        # so `docker run` isn't available inside a job.
+        run: |
+          GITLEAKS_VERSION=8.18.4
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+          /tmp/gitleaks detect --source=. --redact --verbose --exit-code=1
+
+  dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+      - name: Restore
+        run: dotnet restore InboxIntel.sln
+      - name: .NET vulnerable packages (fail on any)
+        # Match dotnet's own "has the following vulnerable packages" line rather
+        # than raw severity words, so package/project names can't false-positive.
+        run: |
+          dotnet list InboxIntel.sln package --vulnerable --include-transitive 2>&1 | tee vuln.txt
+          if grep -q "has the following vulnerable" vuln.txt; then
+            echo "::error::Vulnerable NuGet packages detected — see the table above."
+            exit 1
+          fi
+          echo "No vulnerable NuGet packages."
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: npm audit (production deps, fail on high/critical)
+        # Only production dependencies ship to users; dev-only toolchain advisories
+        # (Vite/PostCSS/etc.) shouldn't block a merge.
+        working-directory: frontend
+        run: npm audit --omit=dev --audit-level=high