feat(app): ship CostasCode with Copilot SDK bridge #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: workplace-security | |
| on: | |
| pull_request: | |
| branches: [copilot-workplace] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| security: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Setup Bun | |
| uses: ./.github/actions/setup-bun | |
| - name: Static workplace gate | |
| run: bun run security:check | |
| - name: Generate deterministic SBOMs | |
| run: | | |
| bun run security:sbom --output artifacts/security/sbom-a.cdx.json | |
| bun run security:sbom --output artifacts/security/sbom-b.cdx.json | |
| cmp artifacts/security/sbom-a.cdx.json artifacts/security/sbom-b.cdx.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: workplace-sbom | |
| path: artifacts/security/sbom-a.cdx.json | |
| - name: Core security tests | |
| working-directory: packages/core | |
| run: bun test test/outbound.test.ts test/effect/observability.test.ts test/project-copy.test.ts | |
| - name: Server security tests | |
| working-directory: packages/opencode | |
| run: bun test test/server/httpapi-cors.test.ts test/server/httpapi-listen.test.ts test/mcp/oauth-callback.test.ts test/effect/runtime-flags.test.ts test/tool/registry.test.ts test/lsp/index.test.ts | |
| - name: App security tests | |
| working-directory: packages/app | |
| run: bun test --preload ./happydom.ts src/context/server.test.ts | |
| - name: Desktop security tests | |
| working-directory: packages/desktop | |
| run: bun test src/main/attachment-picker.test.ts src/main/store-cleanup.test.ts src/main/renderer-url.test.ts |