Skip to content

Commit ba5d6e0

Browse files
frckbricefrckbrice
committed
ci: add security audit to workflow
- Add separate security audit job to check for dependency vulnerabilities - Runs pnpm audit with moderate severity level - Continues on error to not block CI pipeline
1 parent a441797 commit ba5d6e0

File tree

6 files changed

+103
-291
lines changed

6 files changed

+103
-291
lines changed

‎.github/dependabot.yml‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

‎.github/pull_request_template.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@
55

66
## Type of Change
77
<!-- Mark the relevant option with an 'x' -->
8-
- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
9-
- [ ] ✨ New feature (non-breaking change which adds functionality)
10-
- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
11-
- [ ] 📚 Documentation update
12-
- [ ] 🎨 Code style/formatting changes
13-
- [ ] ♻️ Code refactoring
14-
- [ ] ⚡ Performance improvement
15-
- [ ] ✅ Test updates
16-
- [ ] 🔧 Build/config changes
8+
- [ ] Bug fix (non-breaking change which fixes an issue)
9+
- [ ] New feature (non-breaking change which adds functionality)
10+
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
11+
- [ ] Documentation update
12+
- [ ] Code style/formatting changes
13+
- [ ] Code refactoring
14+
- [ ] Performance improvement
15+
- [ ] Test updates
16+
- [ ] Build/config changes
1717

1818
## Related Issues
1919
<!-- Link to related issues using #issue_number -->

‎.github/workflows/ci.yml‎

Lines changed: 94 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Continuous Integration Workflow
2-
#
2+
#
33
# This workflow runs on every push and pull request to ensure code quality.
44
# It performs the following checks:
55
# 1. Type checking (TypeScript compilation without emitting files)
@@ -13,111 +13,101 @@ name: CI
1313

1414
# Trigger the workflow on push and pull requests
1515
on:
16-
push:
17-
branches:
18-
- main
19-
- develop
20-
- 'feature/**'
21-
- 'fix/**'
22-
- 'hotfix/**'
23-
- 'release/**'
24-
pull_request:
25-
branches:
26-
- main
27-
- develop
16+
push:
17+
branches:
18+
- main
19+
- develop
20+
- "feature/**"
21+
- "fix/**"
22+
- "hotfix/**"
23+
- "release/**"
24+
pull_request:
25+
branches:
26+
- main
27+
- develop
2828

2929
# Allow only one concurrent workflow per branch
3030
concurrency:
31-
group: ${{ github.workflow }}-${{ github.ref }}
32-
cancel-in-progress: true
31+
group: ${{ github.workflow }}-${{ github.ref }}
32+
cancel-in-progress: true
3333

3434
jobs:
35-
# Main CI job that runs all checks
36-
ci:
37-
name: CI Checks
38-
runs-on: ubuntu-latest
39-
40-
# Strategy to test against multiple Node.js versions
41-
strategy:
42-
matrix:
43-
node-version: [20.x, 22.x]
44-
fail-fast: false
45-
46-
steps:
47-
# Checkout the repository code
48-
- name: Checkout code
49-
uses: actions/checkout@v4
50-
51-
# Setup pnpm package manager
52-
- name: Setup pnpm
53-
uses: pnpm/action-setup@v4
54-
with:
55-
version: 8
56-
57-
# Setup Node.js with the version from matrix
58-
- name: Setup Node.js ${{ matrix.node-version }}
59-
uses: actions/setup-node@v4
60-
with:
61-
node-version: ${{ matrix.node-version }}
62-
cache: 'pnpm'
63-
64-
# Install dependencies
65-
- name: Install dependencies
66-
run: pnpm install --frozen-lockfile
67-
68-
# Run TypeScript type checking
69-
- name: Type check
70-
run: pnpm check
71-
72-
# Run ESLint to check code quality
73-
- name: Lint
74-
run: pnpm lint
75-
continue-on-error: false
76-
77-
# Run tests with Jest
78-
- name: Test
79-
run: pnpm test
80-
env:
81-
NODE_ENV: test
82-
83-
# Build the TypeScript project
84-
- name: Build
85-
run: pnpm build
86-
87-
# Upload test coverage reports (optional, for coverage visualization)
88-
- name: Upload coverage reports
89-
if: matrix.node-version == '20.x'
90-
uses: codecov/codecov-action@v4
91-
with:
92-
file: ./coverage/lcov.info
93-
flags: unittests
94-
name: codecov-umbrella
95-
fail_ci_if_error: false
96-
97-
# Separate job for security checks (dependencies vulnerability scanning)
98-
security:
99-
name: Security Audit
100-
runs-on: ubuntu-latest
101-
102-
steps:
103-
- name: Checkout code
104-
uses: actions/checkout@v4
105-
106-
- name: Setup pnpm
107-
uses: pnpm/action-setup@v4
108-
with:
109-
version: 8
110-
111-
- name: Setup Node.js
112-
uses: actions/setup-node@v4
113-
with:
114-
node-version: '20.x'
115-
cache: 'pnpm'
116-
117-
- name: Install dependencies
118-
run: pnpm install --frozen-lockfile
119-
120-
# Run pnpm audit to check for known vulnerabilities
121-
- name: Run security audit
122-
run: pnpm audit --audit-level=moderate
123-
continue-on-error: true
35+
# Main CI job that runs all checks
36+
ci:
37+
name: CI Checks
38+
runs-on: ubuntu-latest
39+
40+
# Strategy to test against multiple Node.js versions
41+
strategy:
42+
matrix:
43+
node-version: [20.x, 22.x]
44+
fail-fast: false
45+
46+
steps:
47+
# Checkout the repository code
48+
- name: Checkout code
49+
uses: actions/checkout@v4
50+
51+
# Setup pnpm package manager
52+
- name: Setup pnpm
53+
uses: pnpm/action-setup@v4
54+
with:
55+
version: 8
56+
57+
# Setup Node.js with the version from matrix
58+
- name: Setup Node.js ${{ matrix.node-version }}
59+
uses: actions/setup-node@v4
60+
with:
61+
node-version: ${{ matrix.node-version }}
62+
cache: "pnpm"
63+
64+
# Install dependencies
65+
- name: Install dependencies
66+
run: pnpm install --frozen-lockfile
67+
68+
# Run TypeScript type checking
69+
- name: Type check
70+
run: pnpm check
71+
72+
# Run ESLint to check code quality
73+
- name: Lint
74+
run: pnpm lint
75+
continue-on-error: false
76+
77+
# Run tests with Jest
78+
- name: Test
79+
run: pnpm test
80+
env:
81+
NODE_ENV: test
82+
83+
# Build the TypeScript project
84+
- name: Build
85+
run: pnpm build
86+
87+
# Security audit job to check for dependency vulnerabilities
88+
security:
89+
name: Security Audit
90+
runs-on: ubuntu-latest
91+
92+
steps:
93+
- name: Checkout code
94+
uses: actions/checkout@v4
95+
96+
- name: Setup pnpm
97+
uses: pnpm/action-setup@v4
98+
with:
99+
version: 8
100+
101+
- name: Setup Node.js
102+
uses: actions/setup-node@v4
103+
with:
104+
node-version: "20.x"
105+
cache: "pnpm"
106+
107+
- name: Install dependencies
108+
run: pnpm install --frozen-lockfile
109+
110+
# Run pnpm audit to check for known vulnerabilities
111+
- name: Run security audit
112+
run: pnpm audit --audit-level=moderate
113+
continue-on-error: true

‎.github/workflows/database.yml‎

Lines changed: 0 additions & 69 deletions
This file was deleted.

0 commit comments

Comments
 (0)