|
name: Security Scan |
|
|
|
on: |
|
push: |
|
branches: [ main, develop ] |
|
pull_request: |
|
branches: [ main, develop ] |
|
schedule: |
|
- cron: '0 0 * * 1' # Weekly on Mondays |
|
|
|
jobs: |
|
codeql: |
|
name: CodeQL Analysis |
|
runs-on: ubuntu-latest |
|
timeout-minutes: 15 |
|
permissions: |
|
actions: read |
|
contents: read |
|
security-events: write |
|
|
|
strategy: |
|
fail-fast: false |
|
matrix: |
|
language: [ 'javascript' ] |
|
|
|
steps: |
|
- name: Checkout repository |
|
uses: actions/checkout@v5 |
|
with: |
|
submodules: recursive |
|
|
|
- name: Initialize CodeQL |
|
uses: github/codeql-action/init@v3 |
|
with: |
|
languages: ${{ matrix.language }} |
|
|
|
- name: Autobuild |
|
uses: github/codeql-action/autobuild@v3 |
|
|
|
- name: Perform CodeQL Analysis |
|
uses: github/codeql-action/analyze@v3 |
|
with: |
|
category: "/language:${{matrix.language}}" |
|
|
|
dependency-review: |
|
name: Dependency Review |
|
runs-on: ubuntu-latest |
|
if: github.event_name == 'pull_request' |
|
steps: |
|
- name: Checkout Repository |
|
uses: actions/checkout@v5 |
|
with: |
|
submodules: recursive |
|
- name: Dependency Review |
|
uses: actions/dependency-review-action@v4 |