Repository navigation
ci(security): blocking bun audit policy, secret scan and workflow lint - #1860
Merged
Merged
Conversation
Ported from the old ci/security-pipeline branch, without its Snyk jobs (snyk.yml covers Snyk): security.yml runs on PRs, main and weekly with read-only permissions and no secrets. - Dependency policy: bun audit on bun.lock through scripts/security/audit-policy.mjs; unexcepted high/critical block, exceptions need a reason and an expiry within 90 days. - Secret scan: gitleaks (pinned, checksum-verified, redacted). - Workflow lint: actionlint with shellcheck. Dependencies fixed so the gate starts green, dev tooling only: Storybook 10.6.6, vitest 4.1.12, and overrides lifting undici, vite, zod and source-map-js within range. Runtime packages are unchanged. brace-expansion (ESLint) and webpack-dev-middleware (Storybook dev server) are reviewed, dated exceptions.
✅ Deploy Preview for reframe-os ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 6: the dependency security gate from the old
ci/security-pipelinebranch, ported as a fresh PR on main. The old branch's Snyk jobs are left out, because Snyk has its own workflow (snyk.yml) and you deferred further Snyk work..github/workflows/security.ymlIt runs on PRs to main, pushes to main, weekly (Mondays 04:17 UTC) and on demand. Permissions are
contents: read, and it uses no secrets, so fork PRs are covered.bun audit --jsonpiped throughscripts/security/audit-policy.mjswithsecurity/audit-exceptions.jsonPolicy rules:
bun run audit.Dependency fixes, so the gate starts green
maincurrently has 1 critical and 20 high advisories, all in dev, test or build tooling.image-size).overrides, within existing ranges:undici^7.30.1 (jsdom),vite^8.2.4,zod^4.6.6 (eslint-plugin-react-hooks),source-map-js^1.2.2. The existing@types/react*pins are kept.@ffmpeg/ffmpeg, Datadog RUM, React and Next. A plainbun updatewould have moved@ffmpeg/ffmpeg0.12.10 → 0.12.15 and RUM 7.10 → 7.17, which don't belong in a security PR, so the lockfile changes are limited to the packages above and their own dependencies.brace-expansion(two advisories): ESLint's minimatch, which only expands patterns written in the repo. Two majors are in use, and bun has no nested overrides to pin both.webpack-dev-middleware: Storybook's local dev server. The fix is v7, which Storybook 10.6 doesn't allow.Result: 0 blocking, 5 excepted, 14 moderate or low.
Verified locally
bun run auditexits 0.auditPolicy.test.ts), the app build andbuild-storybookall pass.Docs
docs/SECURITY-PIPELINE.md: the checks, the policy, how to fix or add an exception, and today's triage.Optional maintainer step: add the three jobs as required checks on
main.