--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
.github/workflows/security-scan.yml b8999284e467d3eb14422f9ba37bea954f9930fd (b8999284) Text, 3.00 KB
T8b949e# Security scans migrated from .gitea/workflows/scan.yml.
T8b949e#
T8b949e# Pinned first-party actions (bump tag and SHA together when upgrading):
T8b949e# actions/checkout@v6.0.1 8e8c483db84b4bee98b60c0593521ed34d9990e8
T8b949e# actions/setup-python@v6.2.0 a309ff8b426b58ec0e2a45f0f869d46889d02405
T8b949e# actions/setup-node@v6.1.0 395ad3262231945c25e8478fd5baf05154b1d79f
T8b949e# actions/cache@v4.2.0 1bd1e32a3bdc45362d1e726936510720a7c30a57
T8b949e# FIXME: CVE-2026-3219 affects pip through 26.0.1 waiting for next release to fix for now we ignore it
Tff7b72nameTb4b4b4: Ta5d6ffSecurityTa5d6ff Ta5d6ffscans
Tff7b72onTb4b4b4:
Tff7b72scheduleTb4b4b4:
Tb4b4b4- Tff7b72cronTb4b4b4: Ta5d6ff"Ta5d6ff30Te6edf3 Ta5d6ff12Te6edf3 Ta5d6ff*Te6edf3 Ta5d6ff*Te6edf3 Ta5d6ff1Ta5d6ff"
Tff7b72pushTb4b4b4:
Tff7b72branchesTb4b4b4:
Tb4b4b4- Ta5d6ffmaster
Tb4b4b4- Ta5d6ffdev
Tff7b72workflow_dispatchTb4b4b4:
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72concurrencyTb4b4b4:
Tff7b72groupTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffgithub.workflowTa5d6ff Ta5d6ff}}-${{Ta5d6ff Ta5d6ffgithub.refTa5d6ff Ta5d6ff}}
Tff7b72cancel-in-progressTb4b4b4: Ta5d6fftrue
Tff7b72envTb4b4b4:
Tff7b72FORCE_JAVASCRIPT_ACTIONS_TO_NODE24Tb4b4b4: Ta5d6fftrue
Tff7b72PYTHON_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff3.14Ta5d6ff"
Tff7b72NODE_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff24Ta5d6ff"
Tff7b72UV_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff0.11.15Ta5d6ff"
Tff7b72PNPM_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff11.1.2Ta5d6ff"
Tff7b72COSIGN_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff3.0.6Ta5d6ff"
T8b949e# Official .deb; setup-trivy.sh verifies sigstore + SHA256 (see build-release.yml).
Tff7b72TRIVY_VERSIONTb4b4b4: Ta5d6ff"Ta5d6ff0.69.3Ta5d6ff"
Tff7b72jobsTb4b4b4:
Tff7b72scanTb4b4b4:
Tff7b72runs-onTb4b4b4: Ta5d6ffubuntu-latest
Tff7b72timeout-minutesTb4b4b4: Ta5d6ff45
Tff7b72permissionsTb4b4b4:
Tff7b72contentsTb4b4b4: Ta5d6ffread
Tff7b72stepsTb4b4b4:
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCheckout
Tff7b72usesTb4b4b4: Ta5d6ffactions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetTa5d6ff Ta5d6ffupTa5d6ff Ta5d6ffPython
Tff7b72usesTb4b4b4: Ta5d6ffactions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
Tff7b72withTb4b4b4:
Tff7b72python-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.PYTHON_VERSIONTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInstallTa5d6ff Ta5d6ffUVTa5d6ff Ta5d6ff(PyPITa5d6ff Ta5d6ffpin)
Tff7b72envTb4b4b4:
Tff7b72UV_VERSIONTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.UV_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72runTb4b4b4: Ta5d6ffbashTa5d6ff Ta5d6ffscripts/ci/github-install-uv.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffCacheTa5d6ff Ta5d6ffUVTa5d6ff Ta5d6ffdownloads
Tff7b72usesTb4b4b4: Ta5d6ffactions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57
Tff7b72withTb4b4b4:
Tff7b72pathTb4b4b4: Ta5d6ff~/.cache/uv
Tff7b72keyTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffrunner.osTa5d6ff Ta5d6ff}}-uv-${{Ta5d6ff Ta5d6ffhashFiles('uv.lock')Ta5d6ff Ta5d6ff}}
Tff7b72restore-keysTb4b4b4: Tb4b4b4|
Tff7b72${{ runner.os }}-uv-
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetTa5d6ff Ta5d6ffupTa5d6ff Ta5d6ffNodeTa5d6ff Ta5d6ffandTa5d6ff Ta5d6ffpnpm
Tff7b72usesTb4b4b4: Ta5d6ff./.github/actions/setup-node-pnpm
Tff7b72withTb4b4b4:
Tff7b72node-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.NODE_VERSIONTa5d6ff Ta5d6ff}}
Tff7b72pnpm-versionTb4b4b4: Ta5d6ff${{Ta5d6ff Ta5d6ffenv.PNPM_VERSIONTa5d6ff Ta5d6ff}}
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffInstallTa5d6ff Ta5d6ffdependencies
Tff7b72runTb4b4b4: Ta5d6ffbashTa5d6ff Ta5d6ffscripts/ci/github-install-deps.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffpip-audit
Tff7b72runTb4b4b4: Tb4b4b4|
Tff7b72uv run pip install --upgrade "pip>=26.0" pip-audit
Tff7b72uv run pip-audit --ignore-vuln CVE-2026-3219
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffAptTa5d6ff Ta5d6ffupdateTa5d6ff Ta5d6ff(forTa5d6ff Ta5d6ffTrivyTa5d6ff Ta5d6ff.deb)
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/exec-priv.shTa5d6ff Ta5d6ffapt-getTa5d6ff Ta5d6ffupdateTa5d6ff Ta5d6ff-qq
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffSetupTa5d6ff Ta5d6ffTrivy
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/setup-trivy.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffTrivyTa5d6ff Ta5d6fffilesystemTa5d6ff Ta5d6ffscanTa5d6ff Ta5d6ff(dependencies)
Tff7b72runTb4b4b4: Ta5d6ffshTa5d6ff Ta5d6ffscripts/ci/trivy-fs-scan.sh
Tb4b4b4- Tff7b72nameTb4b4b4: Ta5d6ffTrivyTa5d6ff Ta5d6ffDockerfileTa5d6ff Ta5d6ffmisconfiguration
Tff7b72runTb4b4b4: Ta5d6fftrivyTa5d6ff Ta5d6ffconfigTa5d6ff Ta5d6ff--exit-codeTa5d6ff Ta5d6ff1Ta5d6ff Ta5d6ffDockerfile
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────