mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-27 22:15:33 +00:00
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
name: OSV-Scanner
|
|
|
|
# Dependency vulnerability scan (#2182) via Google's official reusable
|
|
# workflow. Runs weekly and on any PR that touches the dependency manifests.
|
|
# Tokenless: needs zero secrets. Findings are reported in the job log and as
|
|
# a SARIF artifact on the run; code-scanning upload is deliberately disabled
|
|
# so the workflow stays read-only (no security-events: write).
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master]
|
|
paths:
|
|
- 'bun.lock'
|
|
- 'package.json'
|
|
schedule:
|
|
- cron: '30 6 * * 1' # weekly, Monday 06:30 UTC
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
osv-scan:
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
# Required by the reusable workflow's own top-level permissions block —
|
|
# GitHub validates the caller grants a superset AT STARTUP, even with
|
|
# upload-sarif: false (nothing is actually uploaded; see #2117 upstream).
|
|
security-events: write
|
|
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
|
|
with:
|
|
upload-sarif: false
|