Security Scanning & Vulnerability Detection #19
security.yml
on: schedule
Matrix: NPM Audit (Node.js Dependencies)
Matrix: Generate SBOM
Matrix: Trivy Container Scan
Trivy Filesystem Scan
25s
Cargo Audit (Rust Dependencies)
3m 6s
License Compliance Check
2s
Detect Secrets
9s
Docker Compose Security Audit
6s
Matrix: CodeQL Security Analysis
Matrix: Snyk Vulnerability & License Scan
Security Scan Summary
3s
Annotations
44 errors and 34 warnings
|
Generate SBOM (client/Dockerfile, client-sbom.json)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
License Compliance Check
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
Generate SBOM (api/Dockerfile, api-sbom.json)
The strategy configuration was canceled because "sbom-generation.client_Dockerfile_client-" failed
|
|
NPM Audit (Node.js Dependencies) (client)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
Snyk Vulnerability & License Scan (client, node)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
NPM Audit (Node.js Dependencies) (frontend)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
NPM Audit (Node.js Dependencies) (config)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
NPM Audit (Node.js Dependencies) (app)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
NPM Audit (Node.js Dependencies) (components)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
Snyk Vulnerability & License Scan (api, node)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
NPM Audit (Node.js Dependencies) (api)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
Snyk Vulnerability & License Scan (contract, rust)
This request has been automatically failed because it uses a deprecated version of `actions/upload-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
Docker Compose Security Audit
Process completed with exit code 1.
|
|
Trivy Container Scan (client/Dockerfile, stellar-escrow-client)
Path does not exist: stellar-escrow-client-trivy.sarif
|
|
Trivy Container Scan (client/Dockerfile, stellar-escrow-client)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
Trivy Container Scan (client/Dockerfile, stellar-escrow-client)
Process completed with exit code 1.
|
|
Trivy Container Scan (frontend/Dockerfile, stellar-escrow-frontend)
The strategy configuration was canceled because "trivy-scan.client_Dockerfile_stellar" failed
|
|
Trivy Container Scan (frontend/Dockerfile, stellar-escrow-frontend)
Path does not exist: stellar-escrow-frontend-trivy.sarif
|
|
Trivy Container Scan (frontend/Dockerfile, stellar-escrow-frontend)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
Trivy Container Scan (frontend/Dockerfile, stellar-escrow-frontend)
Process completed with exit code 1.
|
|
Trivy Container Scan (indexer/Dockerfile, stellar-escrow-indexer)
The strategy configuration was canceled because "trivy-scan.client_Dockerfile_stellar" failed
|
|
Trivy Container Scan (indexer/Dockerfile, stellar-escrow-indexer)
Path does not exist: stellar-escrow-indexer-trivy.sarif
|
|
Trivy Container Scan (indexer/Dockerfile, stellar-escrow-indexer)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
Trivy Container Scan (indexer/Dockerfile, stellar-escrow-indexer)
The operation was canceled.
|
|
Trivy Container Scan (api/Dockerfile, stellar-escrow-api)
The strategy configuration was canceled because "trivy-scan.client_Dockerfile_stellar" failed
|
|
Trivy Container Scan (api/Dockerfile, stellar-escrow-api)
Path does not exist: stellar-escrow-api-trivy.sarif
|
|
Trivy Container Scan (api/Dockerfile, stellar-escrow-api)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
Trivy Container Scan (api/Dockerfile, stellar-escrow-api)
The operation was canceled.
|
|
Trivy Filesystem Scan
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
Trivy Filesystem Scan
Process completed with exit code 1.
|
|
CodeQL Security Analysis (ruby)
Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.25.6/x64/codeql/codeql database finalize --finalize-dataset --threads=4 --ram=14579 /home/runner/work/_temp/codeql_databases/ruby". Exit code was 32 and last log line was: CodeQL detected code written in JavaScript/TypeScript, Rust, GitHub Actions, Go and Python, but not any written in Ruby. Confirm that there is some source code for Ruby in the project. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.
|
|
CodeQL Security Analysis (ruby)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (java)
We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.25.6/x64/codeql/java/tools/autobuild.sh". Exit code was 1 and last log line was: ERROR: Could not detect a suitable build command for the source checkout. See the logs for more details.
|
|
CodeQL Security Analysis (java)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (csharp)
We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.25.6/x64/codeql/csharp/tools/autobuild.sh". Exit code was 1 and last log line was: Error: Could not auto-detect a suitable build method. See the logs for more details.
|
|
CodeQL Security Analysis (csharp)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (cpp)
We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.25.6/x64/codeql/cpp/tools/autobuild.sh". Exit code was 1 and last log line was: cpp/autobuilder: autobuild summary. See the logs for more details.
|
|
CodeQL Security Analysis (cpp)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (go)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (python)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (typescript)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
CodeQL Security Analysis (javascript)
CodeQL Action major versions v1 and v2 have been deprecated. Please update all occurrences of the CodeQL Action in your workflow files to v3. For more information, see https://github.blog/changelog/2025-01-10-code-scanning-codeql-action-v2-is-now-deprecated/
|
|
Cargo Audit (Rust Dependencies)
Process completed with exit code 2.
|
|
Security Scan Summary
This request has been automatically failed because it uses a deprecated version of `actions/download-artifact: v3`. Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
|
Detect Secrets
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Docker Compose Security Audit
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy Container Scan (client/Dockerfile, stellar-escrow-client)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy Container Scan (frontend/Dockerfile, stellar-escrow-frontend)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy Container Scan (indexer/Dockerfile, stellar-escrow-indexer)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy Container Scan (api/Dockerfile, stellar-escrow-api)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Trivy Filesystem Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/upload-sarif@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (ruby)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/analyze@v2, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (ruby)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (ruby)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (java)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (java)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (java)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (csharp)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (csharp)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (csharp)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (cpp)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (cpp)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (cpp)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (go)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/analyze@v2, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (go)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (go)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (python)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/analyze@v2, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (python)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (python)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (typescript)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/analyze@v2, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (typescript)
Failed to save: Failed to CreateCacheEntry: Received non-retryable error: Failed request: (409) Conflict: cache entry with the same key, version, and scope already exists
|
|
CodeQL Security Analysis (typescript)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (typescript)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
CodeQL Security Analysis (javascript)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, github/codeql-action/analyze@v2, github/codeql-action/autobuild@v2, github/codeql-action/init@v2. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
CodeQL Security Analysis (javascript)
Failed to save: Failed to CreateCacheEntry: Received non-retryable error: Failed request: (409) Conflict: cache entry with the same key, version, and scope already exists
|
|
CodeQL Security Analysis (javascript)
Unable to validate code scanning workflow: DuplicateLanguageInMatrix
|
|
CodeQL Security Analysis (javascript)
1 issue was detected with this workflow: CodeQL language 'javascript' is referenced by more than one entry in the 'language' matrix parameter for job 'codeql-analysis'. This may result in duplicate alerts. Please edit the 'language' matrix parameter to keep only one of the following: 'javascript', 'typescript'.
|
|
Cargo Audit (Rust Dependencies)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|