diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..36e6d7e --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,26 @@ +name: Lint + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + +jobs: + lint: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '18' + cache: 'npm' + + - name: Install Dependencies + run: npm ci + + - name: Run ESLint + run: npm run lint diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..0d4dbf0 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,35 @@ +name: Security Scan + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + schedule: + - cron: '0 0 * * 0' # Run weekly on Sunday at midnight + +jobs: + security_scan: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '18' + cache: 'npm' + + - name: Install Dependencies + run: npm ci + + - name: Run Security Audit + run: npm audit --audit-level=high + + - name: Scan for Secrets + uses: trufflesecurity/trufflehog@v3 + with: + path: ./ + baseRef: ${{ github.event.pull_request.base.ref || github.ref }} + headRef: ${{ github.event.pull_request.head.ref || github.sha }} diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml new file mode 100644 index 0000000..d182c6e --- /dev/null +++ b/.github/workflows/typecheck.yml @@ -0,0 +1,26 @@ +name: Type Check + +on: + push: + branches: [ main, develop ] + pull_request: + branches: [ main, develop ] + +jobs: + typecheck: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + + - name: Use Node.js + uses: actions/setup-node@v3 + with: + node-version: '18' + cache: 'npm' + + - name: Install Dependencies + run: npm ci + + - name: Run TypeScript Type Check + run: npm run typecheck