kazerlelutin
785e1be2aa
CI / quality (push) Waiting to run
CI / e2e-and-a11y (push) Blocked by required conditions
CI / lighthouse (push) Blocked by required conditions
CI / android-smoke (push) Waiting to run
CI / pull-request-report (push) Blocked by required conditions
Security / codeql (push) Waiting to run
Security / deps-and-secrets (push) Waiting to run
52 lines
1.7 KiB
YAML
52 lines
1.7 KiB
YAML
name: Security
|
||
|
||
on:
|
||
pull_request:
|
||
push:
|
||
branches: [main]
|
||
schedule:
|
||
- cron: "0 5 * * 1"
|
||
|
||
jobs:
|
||
codeql:
|
||
# PR depuis fork : pas d’upload SARIF vers le dépôt cible (permissions GitHub).
|
||
# Dépôt sans « Code scanning » activé (Settings → Code security) : l’upload échoue ;
|
||
# `upload: false` garde l’analyse CodeQL sans appeler l’API. Quand le scanning est
|
||
# activé sur le repo, retirer `upload: false` (comportement par défaut = upload).
|
||
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
actions: read
|
||
contents: read
|
||
security-events: write
|
||
steps:
|
||
- uses: actions/checkout@v7
|
||
- uses: github/codeql-action/init@v4
|
||
with:
|
||
languages: javascript-typescript
|
||
- uses: github/codeql-action/analyze@v4
|
||
with:
|
||
upload: false
|
||
|
||
deps-and-secrets:
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: read
|
||
pull-requests: read
|
||
steps:
|
||
# Historique complet : gitleaks compare github.event.before..after sur push ;
|
||
# un clone depth=1 ne contient pas le parent, d’où « unknown revision ».
|
||
- uses: actions/checkout@v7
|
||
with:
|
||
fetch-depth: 0
|
||
- uses: actions/setup-node@v7
|
||
with:
|
||
node-version: 22
|
||
- run: npm ci
|
||
- run: npm run audit:deps
|
||
- name: Secret scan
|
||
# v2 — SHA épinglé (supply chain) ; tag : https://github.com/gitleaks/gitleaks-action/releases
|
||
uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
|
||
env:
|
||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|