chore(deps)(deps): bump pinia from 2.3.1 to 3.0.4 in /rag-ui #7

	name: Security Scan

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main, develop]
	schedule:
	- cron: '0 6 * * 1' # Weekly on Monday

	jobs:
	security:
	runs-on: ubuntu-latest

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	# Backend dependencies scan
	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '20'

	- name: Install backend dependencies
	working-directory: ./rag-api
	run: npm ci

	- name: Run npm audit (backend)
	working-directory: ./rag-api
	run: npm audit --audit-level=moderate
	continue-on-error: true

	# Frontend dependencies scan
	- name: Install frontend dependencies
	working-directory: ./rag-ui
	run: npm ci

	- name: Run npm audit (frontend)
	working-directory: ./rag-ui
	run: npm audit --audit-level=moderate
	continue-on-error: true

	# CodeQL Analysis
	- name: Initialize CodeQL
	uses: github/codeql-action/init@v2
	with:
	languages: javascript, typescript

	- name: Autobuild
	uses: github/codeql-action/autobuild@v2

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@v2

	# Docker image scan
	- name: Build backend image
	working-directory: ./rag-api
	run: docker build -t pkm-backend:test .

	- name: Scan backend image
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: pkm-backend:test
	format: 'sarif'
	output: 'trivy-results.sarif'

	- name: Upload scan results
	uses: github/codeql-action/upload-sarif@v2
	if: always()
	with:
	sarif_file: 'trivy-results.sarif'

Navigation Menu