mirror of https://github.com/garrytan/gstack.git
38 lines
930 B
YAML
38 lines
930 B
YAML
name: CVE Lite dependency audit
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
# Weekly on Monday at 06:00 UTC - catches new advisories between pushes
|
|
- cron: '0 6 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
scan:
|
|
name: Scan dependencies
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Scan for vulnerabilities
|
|
uses: OWASP/cve-lite-cli@2eed959b8641042472d2810444393b88d5454e62 # v1
|
|
with:
|
|
fail-on: high
|
|
sarif: 'true'
|
|
|
|
- name: Upload SARIF to Code Scanning
|
|
if: always() && hashFiles('*.sarif') != ''
|
|
uses: github/codeql-action/upload-sarif@411bbbe57033eedfc1a82d68c01345aa96c737d7 # v4
|
|
with:
|
|
sarif_file: cve-lite-*.sarif
|
|
category: cve-lite
|