chore(deps): bump actions/setup-node from 4.4.0 to 6.3.0 #4
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependency vulnerability audit | |
| # | |
| # Auto-detects ecosystems present in the repository and runs the appropriate | |
| # audit tool. Fails the build if any dependency has a known security advisory. | |
| # | |
| # Add "dependency-audit" as a required status check in branch protection. | |
| # | |
| # Pinned tool versions (update deliberately): | |
| # govulncheck v1.1.4 | cargo-audit 0.21.1 | pip-audit 2.9.0 | |
| name: Dependency audit | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| detect: | |
| name: Detect ecosystems | |
| runs-on: ubuntu-latest | |
| outputs: | |
| npm: ${{ steps.check.outputs.npm }} | |
| gomod: ${{ steps.check.outputs.gomod }} | |
| cargo: ${{ steps.check.outputs.cargo }} | |
| pip: ${{ steps.check.outputs.pip }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| - name: Detect package ecosystems | |
| id: check | |
| run: | | |
| # npm — look for package-lock.json anywhere (excluding node_modules) | |
| if find . -name 'package-lock.json' -not -path '*/node_modules/*' | grep -q .; then | |
| echo "npm=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "npm=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Go modules — detect via go.mod (not go.sum, which may not exist) | |
| if find . -name 'go.mod' -not -path '*/vendor/*' | grep -q .; then | |
| echo "gomod=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "gomod=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Cargo — detect via Cargo.toml anywhere (lockfile may not exist for libraries) | |
| if find . -name 'Cargo.toml' -not -path '*/target/*' | grep -q .; then | |
| echo "cargo=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "cargo=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Python — detect pyproject.toml or requirements.txt anywhere | |
| if find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q . || \ | |
| find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q .; then | |
| echo "pip=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "pip=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| audit-npm: | |
| name: npm audit | |
| needs: detect | |
| if: needs.detect.outputs.npm == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: "lts/*" | |
| - name: Audit npm dependencies | |
| run: | | |
| # Audit each package-lock.json found in the repo | |
| status=0 | |
| while IFS= read -r dir; do | |
| echo "::group::npm audit $dir" | |
| if ! (cd "$dir" && npm audit --audit-level=low); then | |
| status=1 | |
| fi | |
| echo "::endgroup::" | |
| done < <(find . -name 'package-lock.json' -not -path '*/node_modules/*' -exec dirname {} \;) | |
| exit $status | |
| audit-go: | |
| name: govulncheck | |
| needs: detect | |
| if: needs.detect.outputs.gomod == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5 | |
| with: | |
| go-version: "stable" | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 | |
| - name: Audit Go dependencies | |
| run: | | |
| status=0 | |
| while IFS= read -r dir; do | |
| echo "::group::govulncheck $dir" | |
| if ! (cd "$dir" && govulncheck ./...); then | |
| status=1 | |
| fi | |
| echo "::endgroup::" | |
| done < <(find . -name 'go.mod' -not -path '*/vendor/*' -exec dirname {} \;) | |
| exit $status | |
| audit-cargo: | |
| name: cargo audit | |
| needs: detect | |
| if: needs.detect.outputs.cargo == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit@0.21.1 --locked | |
| - name: Audit Cargo dependencies | |
| run: | | |
| # cargo audit operates on Cargo.lock at workspace root | |
| # For workspaces, a single audit at root covers all crates | |
| status=0 | |
| while IFS= read -r dir; do | |
| echo "::group::cargo audit $dir" | |
| if ! (cd "$dir" && { cargo generate-lockfile 2>/dev/null || true; cargo audit; }); then | |
| status=1 | |
| fi | |
| echo "::endgroup::" | |
| done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u) | |
| exit $status | |
| audit-pip: | |
| name: pip-audit | |
| needs: detect | |
| if: needs.detect.outputs.pip == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.x" | |
| - name: Install pip-audit | |
| run: pip install pip-audit==2.9.0 | |
| - name: Audit Python dependencies | |
| run: | | |
| status=0 | |
| # Audit each Python project found in the repo | |
| while IFS= read -r dir; do | |
| echo "::group::pip-audit $dir" | |
| if [ -f "$dir/requirements.txt" ]; then | |
| if ! pip-audit -r "$dir/requirements.txt"; then | |
| status=1 | |
| fi | |
| elif [ -f "$dir/pyproject.toml" ]; then | |
| echo "::warning file=$dir/pyproject.toml::pip-audit requires a requirements file or installed environment. Add a committed requirements.txt to audit this project in CI." | |
| fi | |
| echo "::endgroup::" | |
| done < <( | |
| { | |
| find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \; | |
| find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \; | |
| } | sort -u | |
| ) | |
| exit $status |