Insurance #75
security-scan.yml
on: pull_request
cargo audit
3m 5s
Secret scan (gitleaks)
10s
IaC scan (checkov)
35s
Matrix: CodeQL SAST
Matrix: npm audit
Matrix: Trivy container scan
Annotations
23 errors and 15 warnings
|
npm audit (app)
Process completed with exit code 1.
|
|
npm audit (client)
The strategy configuration was canceled because "npm-audit.app" failed
|
|
npm audit (api)
The strategy configuration was canceled because "npm-audit.app" failed
|
|
npm audit (client)
Process completed with exit code 1.
|
|
npm audit (api)
Process completed with exit code 1.
|
|
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
Path does not exist: trivy-stellar-escrow-client.sarif
|
|
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
Process completed with exit code 1.
|
|
npm audit (components)
The strategy configuration was canceled because "npm-audit.app" failed
|
|
npm audit (components)
The operation was canceled.
|
|
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
The strategy configuration was canceled because "trivy-scan.client_client_Dockerfile_" failed
|
|
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
Path does not exist: trivy-stellar-escrow-api.sarif
|
|
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
The operation was canceled.
|
|
IaC scan (checkov)
CKV_AWS_354: "Ensure RDS Performance Insights are encrypted using KMS CMKs"
|
|
IaC scan (checkov)
CKV_AWS_129: "Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled"
|
|
IaC scan (checkov)
CKV_AWS_23: "Ensure every security group and rule has a description"
|
|
IaC scan (checkov)
CKV_AWS_382: "Ensure no security groups allow egress from 0.0.0.0:0 to port -1"
|
|
IaC scan (checkov)
CKV_AWS_338: "Ensure CloudWatch log groups retains logs for at least 1 year"
|
|
IaC scan (checkov)
CKV_AWS_158: "Ensure that CloudWatch Log Group is encrypted by KMS"
|
|
IaC scan (checkov)
CKV_AWS_136: "Ensure that ECR repositories are encrypted using KMS"
|
|
IaC scan (checkov)
CKV_AWS_51: "Ensure ECR Image Tags are immutable"
|
|
IaC scan (checkov)
CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
|
|
IaC scan (checkov)
CKV_AWS_149: "Ensure that Secrets Manager secret is encrypted using KMS CMK"
|
|
cargo audit
Process completed with exit code 1.
|
|
npm audit (app)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
npm audit (client)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
npm audit (api)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy container scan (client, client/Dockerfile, stellar-escrow-client)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
Secret scan (gitleaks)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, gitleaks/gitleaks-action@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
npm audit (components)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy container scan (api, api/Dockerfile, stellar-escrow-api)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
IaC scan (checkov)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, github/codeql-action/upload-sarif@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
IaC scan (checkov)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
CodeQL SAST (javascript-typescript)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, github/codeql-action/analyze@v3, github/codeql-action/autobuild@v3, github/codeql-action/init@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL SAST (javascript-typescript)
Starting April 2026, the CodeQL Action will skip computing file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses.
To opt out of this change, set the `CODEQL_ACTION_FILE_COVERAGE_ON_PRS` environment variable to `true`.
|
|
CodeQL SAST (javascript-typescript)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
|
|
cargo audit
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
cargo-audit-report
Expired
|
3.61 KB |
sha256:db45a50144af09ec2705e0cb3d8f2fbb0a62048b0ac5311f9ccd35204393d3bd
|
|
|
gitleaks-results.sarif
Expired
|
6.63 KB |
sha256:4b17628a01a6e4a48bfa01cbfef6b20449ba6aeca5e5b36947843b30ed481a99
|
|
|
npm-audit-api
Expired
|
322 Bytes |
sha256:fcf7076d14ab76244cab9701db5b9e4f6898c15e89b980f62893e7cece431398
|
|
|
npm-audit-app
Expired
|
322 Bytes |
sha256:677ab136af657650d02a02d95a525ff3e626b3465d73961ef157774645a80556
|
|
|
npm-audit-client
Expired
|
328 Bytes |
sha256:7649ed8b68d60cfe41837a01ed20b817c96661c91c88c38c25d88268d1ddc951
|
|
|
npm-audit-components
Expired
|
336 Bytes |
sha256:2c1605406b3cf1a10708b8339184e8beff2836be1b233d607ce2979e1b7d1fcc
|
|