36 lines
775 B
YAML
36 lines
775 B
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [ main, develop ]
|
|
pull_request:
|
|
branches: [ main, develop ]
|
|
schedule:
|
|
- cron: '0 0 * * 0' # Run weekly on Sunday at midnight
|
|
|
|
jobs:
|
|
security_scan:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Use Node.js
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '18'
|
|
cache: 'npm'
|
|
|
|
- name: Install Dependencies
|
|
run: npm ci
|
|
|
|
- name: Run Security Audit
|
|
run: npm audit --audit-level=high
|
|
|
|
- name: Scan for Secrets
|
|
uses: trufflesecurity/trufflehog@v3.90.1
|
|
with:
|
|
path: ./
|
|
baseRef: ${{ github.event.pull_request.base.ref || github.ref }}
|
|
headRef: ${{ github.event.pull_request.head.ref || github.sha }}
|