chore(deps-dev): Bump eslint from 8.57.1 to 10.7.0 #219
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| node: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run lint:js | |
| - run: npm run test:js | |
| python: | |
| runs-on: ubuntu-latest | |
| env: | |
| # Dummy credentials: the Alpaca SDK rejects empty keys at client | |
| # construction; the test suite makes no network calls. | |
| ALPACA_API_KEY_ID: ci-dummy | |
| ALPACA_SECRET_KEY: ci-dummy | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: npm ci | |
| - run: python -m venv .venv | |
| - run: .venv/bin/pip install -r requirements.txt | |
| - run: npm run test:py | |
| - run: npm run lint:py | |
| - run: npm run typecheck:py | |
| - run: npm run security:py | |
| secret-scan: | |
| name: Secret scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| # Belt-and-suspenders on top of .gitignore: fails if a live API key | |
| # (Alpaca, Gemini, SMTP) or other credential ever lands in a commit — | |
| # scans full history on every push/PR, not just the current tree. | |
| - name: Run gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| audit-js: | |
| name: Dependency audit (npm) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - run: npm ci | |
| # High/critical only: complements Dependabot's version-bump PRs with a | |
| # hard gate against known-vulnerable dependencies on every PR. | |
| - run: npm audit --audit-level=high | |
| audit-py: | |
| name: Dependency audit (pip-audit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - run: python -m venv .venv | |
| # pip/setuptools are venv build tooling (not project deps) but pip-audit | |
| # still flags them; keep them current so the audit reflects real | |
| # application-dependency risk. | |
| - run: .venv/bin/pip install --upgrade pip setuptools | |
| - run: .venv/bin/pip install -r requirements.txt pip-audit | |
| - run: .venv/bin/pip-audit |