58 lines
1.7 KiB
YAML
58 lines
1.7 KiB
YAML
name: Security Checks
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
|
|
- name: Reject committed private keys
|
|
shell: bash
|
|
run: |
|
|
if git grep -n -E -- '-----BEGIN ([A-Z0-9 ]+ )?PRIVATE KEY-----'; then
|
|
echo 'Committed private key detected.'
|
|
exit 1
|
|
fi
|
|
- name: Setup Go environment
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
|
|
with:
|
|
go-version: '1.26.6'
|
|
- name: Verify Go dependencies
|
|
run: cd server && go mod verify
|
|
- name: Run Go tests
|
|
run: cd server && go test ./...
|
|
- name: Run Go static analysis
|
|
run: cd server && go vet ./...
|
|
- name: Run Go race tests
|
|
run: cd server && go test -race ./...
|
|
- name: Run Go security analysis
|
|
run: |
|
|
go install github.com/securego/gosec/v2/cmd/gosec@v2.22.10
|
|
cd server && gosec ./...
|
|
- name: Scan Go vulnerabilities
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
|
|
cd server && govulncheck ./...
|
|
- name: Setup Node.js environment
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version: 24
|
|
- name: Install Yarn
|
|
run: npm install --global yarn@1.22.22
|
|
- name: Verify frontend dependencies and build
|
|
run: |
|
|
cd fe
|
|
yarn install --frozen-lockfile
|
|
yarn audit --groups dependencies
|
|
yarn eslint . --ext .vue,.js,.jsx,.cjs,.mjs --ignore-path .gitignore
|
|
yarn build
|