From 349969fe99d678b8b725cd6ff340a07e53cfa2e2 Mon Sep 17 00:00:00 2001 From: mikezylos Date: Tue, 4 Aug 2026 19:22:22 +0800 Subject: [PATCH] ci: align security jobs with the house standard Adds the two security jobs coco-dashboard runs that this repo lacked: - Semgrep (semgrep/semgrep container, --config auto --error --severity ERROR) - dependency audit via npm audit --audit-level=high CodeQL is kept rather than replaced. It is free on public repositories, and it caught a high-severity ReDoS in this repo's own guard script that Semgrep's 200 auto rules did not flag when run against the same pattern -- so the two are complementary and dropping either would lose coverage. OSV-Scanner is not included: it scans a lockfile, and this package declares no dependencies and ships no lockfile, so the job would report on nothing. --- .github/workflows/ci.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 86a8445..1281f6c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,6 +70,32 @@ jobs: queries: security-extended - uses: github/codeql-action/analyze@v3 + semgrep: + name: SAST (Semgrep) + runs-on: ubuntu-latest + container: + image: semgrep/semgrep + steps: + - uses: actions/checkout@v4 + - run: semgrep scan --config auto --error --severity ERROR + + dependency-audit: + name: Dependency audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: '22' + - name: Audit dependencies + run: | + set -euo pipefail + # The package declares no dependencies today, so this passes trivially. It is + # wired up anyway: the moment a dependency is added the audit becomes real and + # blocking, instead of being something someone has to remember to add. + npm install --package-lock-only --no-audit --no-fund + npm audit --audit-level=high + secret-scan: name: Secret scan runs-on: ubuntu-latest