mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-29 16:39:15 +00:00
9aaa3be05f
Co-authored-by: Sinabina <sinabina@Sinabinas-MacBook-Pro-4.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
30 lines
841 B
YAML
30 lines
841 B
YAML
name: OSV-Scanner
|
|
|
|
# Dependency vulnerability scan (#2182) via Google's official reusable
|
|
# workflow. Runs weekly and on any PR that touches the dependency manifests.
|
|
# Tokenless: needs zero secrets. Findings are reported in the job log and as
|
|
# a SARIF artifact on the run; code-scanning upload is deliberately disabled
|
|
# so the workflow stays read-only (no security-events: write).
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master]
|
|
paths:
|
|
- 'bun.lock'
|
|
- 'package.json'
|
|
schedule:
|
|
- cron: '30 6 * * 1' # weekly, Monday 06:30 UTC
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
osv-scan:
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
|
|
with:
|
|
upload-sarif: false
|