chore(deps): bump jest from 30.4.2 to 30.5.0 in the testing group #1054
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Security | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - release/** | |
| push: | |
| branches: | |
| - main | |
| - release/** | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash | |
| env: | |
| LC_ALL: C.UTF-8 | |
| permissions: | |
| contents: read | |
| concurrency: | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| group: pr-checks-${{ github.workflow }}-${{ github.head_ref || github.run_id }} | |
| jobs: | |
| codeql: | |
| if: github.ref == 'refs/heads/main' | |
| name: CodeQL | |
| runs-on: transaction-tools-linux-medium | |
| permissions: | |
| security-events: write # Required for uploading SARIF | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install pnpm | |
| uses: step-security/action-setup@c9d80a280aaf584da8c913342a763a6de6452c7a # v6.0.10 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: package.json | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| build-mode: none | |
| languages: javascript-typescript | |
| queries: security-extended | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| category: "/language:javascript" | |
| pnpm-audit: | |
| name: PNPM Audit | |
| runs-on: transaction-tools-linux-medium | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install pnpm | |
| uses: step-security/action-setup@c9d80a280aaf584da8c913342a763a6de6452c7a # v6.0.10 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: package.json | |
| - name: Audit Dependencies | |
| run: | | |
| # --ignore-unfixable silences advisories whose patched version does not exist on | |
| # npm yet (nothing to install even if we wanted to fix it). | |
| # | |
| # For supply-chain attacks where a fix version EXISTS but is itself malicious, | |
| # suppress the advisory by GHSA ID. Keep each entry in sync with the matching | |
| # override in pnpm-workspace.yaml and the ignore rule in .github/dependabot.yml. | |
| # Remove the flag once a clean patched version is confirmed safe. | |
| # Template (add one --ignore per affected advisory): | |
| # --ignore GHSA-xxxx-xxxx-xxxx # pkg >=bad.ver — attack date, brief note | |
| pnpm audit --audit-level=high --ignore-unfixable | |
| semgrep: | |
| if: github.ref == 'refs/heads/main' | |
| name: Semgrep | |
| permissions: | |
| security-events: write # Required for uploading SARIF | |
| runs-on: transaction-tools-linux-medium | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Install Semgrep | |
| run: pip install semgrep==1.168.0 | |
| - name: Run Semgrep | |
| run: semgrep scan --error --sarif --output semgrep.sarif | |
| - name: Upload SARIF | |
| if: ${{ always() }} | |
| uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 | |
| with: | |
| category: semgrep | |
| sarif_file: semgrep.sarif |