NexusPi Git Node
.github/workflows/security.yml 2230d76a6c2f8f4d9117534fe39068d0ae8a5e05 (2230d76a) Text, 5.67 KB
T8b949e# Dependency audits, filesystem/container config scans, and CodeQL analysis.
T8b949e#
T8b949e# Pinned first-party actions (bump tag and SHA together when upgrading):
T8b949e# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
T8b949e# actions/download-artifact@v5.0.0 634f93cb2916e3fdff6788551b99b062d0335ce0
T8b949e# github/codeql-action/init@v4.31.6 95e58e9a2cdfd71adc6e0353d5c52f41a045d225
T8b949e# github/codeql-action/analyze@v4.31.6 95e58e9a2cdfd71adc6e0353d5c52f41a045d225
Tff7b72nameTb4b4b4: Ta5d6ffSecurity
Tff7b72onTb4b4b4:
Tff7b72pushTb4b4b4:
Tff7b72branchesTb4b4b4:
Tb4b4b4- Ta5d6ffmaster
Tb4b4b4- Ta5d6ffdev
Tff7b72pull_requestTb4b4b4:
Tff7b72branchesTb4b4b4:
Tb4b4b4- Ta5d6ffmaster
Tb4b4b4- Ta5d6ffdev
Tff7b72scheduleTb4b4b4:
Tb4b4b4- Tff7b72cronTb4b4b4: Ta5d6ff"Ta5d6ff30Te6edf3 Ta5d6ff12Te6edf3 Ta5d6ff*Te6edf3 Ta5d6ff*Te6edf3 Ta5d6ff1Ta5d6ff"
Tb4b4b4- Tff7b72cronTb4b4b4: Ta5d6ff"Ta5d6ff35Te6edf3 Ta5d6ff18Te6edf3 Ta5d6ff*Te6edf3 Ta5d6ff*Te6edf3 Ta5d6ff3Ta5d6ff"
Tff7b72workflow_dispatchTb4b4b4:
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72concurrencyTb4b4b4:
Tff7b72groupTb4b4b4: Ta5d6ffsecurity-${{Ta5d6ff Ta5d6ffgithub.workflowTa5d6ff Ta5d6ff}}-${{Ta5d6ff Ta5d6ffgithub.event.pull_request.numberTa5d6ff Ta5d6ff||Ta5d6ff Ta5d6ffgithub.refTa5d6ff Ta5d6ff}}
Tff7b72cancel-in-progressTb4b4b4: Ta5d6fftrue
Tff7b72envTb4b4b4:
Tff7b72FORCE_JAVASCRIPT_ACTIONS_TO_NODE24Tb4b4b4: Ta5d6fftrue
Tff7b72NODE_OPTIONSTb4b4b4: Ta5d6ff--max-old-space-size=8192
Tff7b72PYTHON_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff3.14Ta5d6ff"
Tff7b72NODE_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff24Ta5d6ff"
Tff7b72UV_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff0.11.15Ta5d6ff"
Tff7b72PNPM_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff11.1.2Ta5d6ff"
Tff7b72TRIVY_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff0.69.3Ta5d6ff"
Tff7b72jobsTb4b4b4:
Tff7b72dependency-auditTb4b4b4:
Tff7b72nameTb4b4b4: Ta5d6ffDependencyTa5d6ff Ta5d6ffandTa5d6ff Ta5d6ffconfigTa5d6ff Ta5d6ffscan
Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest
Tff7b72timeout-minutesTb4b4b4: Ta5d6ff45
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72stepsTb4b4b4:
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCheckout
Tff7b72usesTb4b4b4: Ta5d6ffactions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetTa5d6ff Ta5d6ffupTa5d6ff Ta5d6ffdevelopmentTa5d6ff Ta5d6ffenvironment
Tff7b72usesTb4b4b4: Ta5d6ff./.github/actions/setup-dev-environment
Tff7b72withTb4b4b4:
Tff7b72python-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.PYTHON_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72uv-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.UV_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72node-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.NODE_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72pnpm-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.PNPM_VERSIONTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffpip-audit
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72uv run pip install --upgrade "pip>=26.1" pip-audit
Tff7b72uv run pip-audit
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffAptTa5d6ff Ta5d6ffupdateTa5d6ff Ta5d6ff(forTa5d6ff Ta5d6ffTrivyTa5d6ff Ta5d6ff.deb)
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/exec-priv.shTa5d6ff Ta5d6ffapt-getTa5d6ff Ta5d6ffupdateTa5d6ff Ta5d6ff-qq
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetupTa5d6ff Ta5d6ffTrivy
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/setup-trivy.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffTrivyTa5d6ff Ta5d6fffilesystemTa5d6ff Ta5d6ffscanTa5d6ff Ta5d6ff(dependencies)
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/trivy-fs-scan.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffTrivyTa5d6ff Ta5d6ffDockerfileTa5d6ff Ta5d6ffmisconfiguration
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72set -euo pipefail
Tff7b72for f in Dockerfile Dockerfile.hardened; do
Tff7b72trivy config --exit-code 1 "$f"
Tff7b72done
Tff7b72frontendTb4b4b4:
Tff7b72nameTb4b4b4: Ta5d6ffBuildTa5d6ff Ta5d6fffrontendTa5d6ff Ta5d6ffartifactTa5d6ff Ta5d6ff(CodeQL)
Tff7b72usesTb4b4b4: Ta5d6ff./.github/workflows/frontend-build.yml
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72withTb4b4b4:
Tff7b72artifact_nameTb4b4b4: Ta5d6ffmeshchatx-frontend-codeql-${{Ta5d6ff Ta5d6ffgithub.run_idTa5d6ff Ta5d6ff}}-${{Ta5d6ff Ta5d6ffgithub.run_attemptTa5d6ff Ta5d6ff}}
Tff7b72retention_daysTb4b4b4: Ta5d6ff1
Tff7b72codeqlTb4b4b4:
Tff7b72nameTb4b4b4: Ta5d6ffCodeQLTa5d6ff Ta5d6ff(${{Ta5d6ff Ta5d6ffmatrix.languageTa5d6ff Ta5d6ff}})
Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest
Tff7b72timeout-minutesTb4b4b4: Ta5d6ff360
Tff7b72permissionsTb4b4b4:
Tff7b72security-eventsTb4b4b4: Ta5d6ffwrite
Tff7b72packagesTb4b4b4: Ta5d6ffread
Tff7b72actionsTb4b4b4: Ta5d6ffread
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72strategyTb4b4b4:
Tff7b72fail-fastTb4b4b4: Ta5d6fffalse
Tff7b72matrixTb4b4b4:
Tff7b72includeTb4b4b4:
Tb4b4b4- Tff7b72languageTb4b4b4: Ta5d6ffactions
Tff7b72build-modeTb4b4b4: Ta5d6ffnone
Tb4b4b4- Tff7b72languageTb4b4b4: Ta5d6ffgo
Tff7b72build-modeTb4b4b4: Ta5d6ffautobuild
Tb4b4b4- Tff7b72languageTb4b4b4: Ta5d6ffjava-kotlin
Tff7b72build-modeTb4b4b4: Ta5d6ffnone
Tb4b4b4- Tff7b72languageTb4b4b4: Ta5d6ffpython
Tff7b72build-modeTb4b4b4: Ta5d6ffnone
Tff7b72stepsTb4b4b4:
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCheckoutTa5d6ff Ta5d6ffrepository
Tff7b72usesTb4b4b4: Ta5d6ffactions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInitializeTa5d6ff Ta5d6ffCodeQL
Tff7b72usesTb4b4b4: Ta5d6ffgithub/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
Tff7b72withTb4b4b4:
Tff7b72languagesTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffmatrix.languageTa5d6ff Ta5d6ff}}
Tff7b72build-modeTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffmatrix.build-modeTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffPerformTa5d6ff Ta5d6ffCodeQLTa5d6ff Ta5d6ffAnalysis
Tff7b72usesTb4b4b4: Ta5d6ffgithub/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
Tff7b72withTb4b4b4:
Tff7b72categoryTb4b4b4: Ta5d6ff"Ta5d6ff/language:${{matrix.language}}Ta5d6ff"
Tff7b72codeql-javascriptTb4b4b4:
Tff7b72nameTb4b4b4: Ta5d6ffCodeQLTa5d6ff Ta5d6ff(javascript-typescript)
Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest
Tff7b72needsTb4b4b4: Tb4b4b4[Te6edf3frontendTb4b4b4]
Tff7b72timeout-minutesTb4b4b4: Ta5d6ff360
Tff7b72permissionsTb4b4b4:
Tff7b72security-eventsTb4b4b4: Ta5d6ffwrite
Tff7b72packagesTb4b4b4: Ta5d6ffread
Tff7b72actionsTb4b4b4: Ta5d6ffread
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72envTb4b4b4:
Tff7b72MESHCHATX_FRONTEND_PREBUILTTb4b4b4: Ta5d6ff"Ta5d6ff1Ta5d6ff"
Tff7b72FRONTEND_ARTIFACT_NAMETb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffneeds.frontend.outputs.artifact_nameTa5d6ff Ta5d6ff}}
Tff7b72stepsTb4b4b4:
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCheckoutTa5d6ff Ta5d6ffrepository
Tff7b72usesTb4b4b4: Ta5d6ffactions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetTa5d6ff Ta5d6ffupTa5d6ff Ta5d6ffdevelopmentTa5d6ff Ta5d6ffenvironment
Tff7b72usesTb4b4b4: Ta5d6ff./.github/actions/setup-dev-environment
Tff7b72withTb4b4b4:
Tff7b72python-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.PYTHON_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72uv-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.UV_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72node-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.NODE_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72pnpm-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.PNPM_VERSIONTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffFetchTa5d6ff Ta5d6fffrontendTa5d6ff Ta5d6ffartifact
Tff7b72usesTb4b4b4: Ta5d6ff./.github/actions/fetch-frontend-artifact
Tff7b72withTb4b4b4:
Tff7b72artifact-nameTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.FRONTEND_ARTIFACT_NAMETa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInitializeTa5d6ff Ta5d6ffCodeQL
Tff7b72usesTb4b4b4: Ta5d6ffgithub/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
Tff7b72withTb4b4b4:
Tff7b72languagesTb4b4b4: Ta5d6ffjavascript-typescript
Tff7b72build-modeTb4b4b4: Ta5d6ffnone
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffPerformTa5d6ff Ta5d6ffCodeQLTa5d6ff Ta5d6ffAnalysis
Tff7b72usesTb4b4b4: Ta5d6ffgithub/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
Tff7b72withTb4b4b4:
Tff7b72categoryTb4b4b4: Ta5d6ff"Ta5d6ff/language:javascript-typescriptTa5d6ff"
Served by rngit 1.5.2 - Generated in 0.02s