From 557eeb9d435cdb0b26190953ee6597df675e4ff1 Mon Sep 17 00:00:00 2001 From: mikezylos Date: Tue, 4 Aug 2026 19:24:38 +0800 Subject: [PATCH] ci: align security jobs with the house standard Adds the two security jobs coco-dashboard runs that this repo lacked: - Semgrep (semgrep/semgrep container, --config auto --error --severity ERROR) - dependency audit via npm audit --audit-level=high CodeQL is kept rather than replaced. It is free on public repositories, and it caught a high-severity ReDoS in this repo's own guard script that Semgrep's 200 auto rules did not flag when run against the same pattern, so the two are complementary and dropping either would lose coverage. OSV-Scanner is not included: it scans a lockfile, and this package declares no dependencies and ships no lockfile, so the job would report on nothing. --- .github/workflows/ci.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 86a8445..1281f6c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,6 +70,32 @@ jobs: queries: security-extended - uses: github/codeql-action/analyze@v3 + semgrep: + name: SAST (Semgrep) + runs-on: ubuntu-latest + container: + image: semgrep/semgrep + steps: + - uses: actions/checkout@v4 + - run: semgrep scan --config auto --error --severity ERROR + + dependency-audit: + name: Dependency audit + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: '22' + - name: Audit dependencies + run: | + set -euo pipefail + # The package declares no dependencies today, so this passes trivially. It is + # wired up anyway: the moment a dependency is added the audit becomes real and + # blocking, instead of being something someone has to remember to add. + npm install --package-lock-only --no-audit --no-fund + npm audit --audit-level=high + secret-scan: name: Secret scan runs-on: ubuntu-latest