cesnimda
87d44537b9
security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and pushes to main/develop (detective backstop to the pre-commit hook). deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated local staging stack (needs a self-hosted Windows runner). deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready to activate once the Linux server + its runner exist. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
name: Security
|
|
|
|
# Scans run alongside CI on every PR and on pushes to the long-lived branches.
|
|
# This is the DETECTIVE layer (backstop). The PREVENTIVE layer is the local
|
|
# pre-commit hook — this catches anything that slipped past it (e.g. --no-verify)
|
|
# and scans the full history, not just the staged diff.
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
|
|
jobs:
|
|
secrets:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # full history so gitleaks scans every commit
|
|
- name: Secret scan (gitleaks)
|
|
run: |
|
|
docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest \
|
|
detect --source=/repo --redact --verbose --exit-code 1
|
|
|
|
dependencies:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '8.0.x'
|
|
- name: Restore
|
|
run: dotnet restore InboxIntel.sln
|
|
- name: .NET vulnerable packages (fail on any)
|
|
run: |
|
|
dotnet list InboxIntel.sln package --vulnerable --include-transitive 2>&1 | tee vuln.txt
|
|
if grep -qiE 'Critical|High|Moderate|Low' vuln.txt; then
|
|
echo "::error::Vulnerable NuGet packages detected — see the table above."
|
|
exit 1
|
|
fi
|
|
echo "No vulnerable NuGet packages."
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
- name: npm audit (fail on high/critical)
|
|
working-directory: frontend
|
|
run: npm audit --audit-level=high
|