Update source SHA: hello #70
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Plugin Security Scan | |
| on: | |
| pull_request: | |
| paths: | |
| - 'plugins/**/*.json' | |
| push: | |
| paths: | |
| - 'plugins/**/*.json' | |
| jobs: | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Run security scan on changed manifests | |
| id: scan | |
| run: | | |
| node scripts/scan-plugin.js ${{ github.event.pull_request.number || '' }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Comment on PR with results | |
| if: github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| let scanResults = []; | |
| try { | |
| scanResults = JSON.parse(fs.readFileSync('/tmp/scan-results.json', 'utf8')); | |
| } catch (e) { | |
| console.log('No scan results file found'); | |
| return; | |
| } | |
| for (const result of scanResults) { | |
| let comment = `## 🔍 Security Scan: ${result.plugin}\n\n`; | |
| if (result.status === 'safe') { | |
| comment += '✅ **Status**: Clean - No issues detected\n\n'; | |
| comment += 'This plugin has passed automated security checks.'; | |
| } else if (result.status === 'warning') { | |
| comment += '⚠️ **Status**: Warnings detected\n\n'; | |
| comment += '**Issues found:**\n'; | |
| result.issues.forEach(issue => { | |
| comment += `- ${issue}\n`; | |
| }); | |
| comment += '\n📋 This requires manual review before merging.'; | |
| } else { | |
| comment += '🚨 **Status**: Suspicious patterns detected\n\n'; | |
| comment += '**Critical issues:**\n'; | |
| result.issues.forEach(issue => { | |
| comment += `- ${issue}\n`; | |
| }); | |
| comment += '\n❌ This plugin cannot be merged without thorough manual review.'; | |
| } | |
| await github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: comment | |
| }); | |
| } |