mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-27 21:19:18 +00:00
b075a9c8d4
* test: symlink-walker tests use a non-metafile probe (README now skipped by design, #2315) The import walker deliberately skips README/metafiles since #2315 (closing #345); the symlink-hardening tests used README.md as their probe file and went red on the intersection. Probe with notes.md instead; test intent (cycle hardening + strategy filter) unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci: grant security-events write to the OSV caller job — reusable workflow requires it at startup Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Sinabina <sinabina@Sinabinas-MacBook-Pro-4.local> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
name: OSV-Scanner
|
|
|
|
# Dependency vulnerability scan (#2182) via Google's official reusable
|
|
# workflow. Runs weekly and on any PR that touches the dependency manifests.
|
|
# Tokenless: needs zero secrets. Findings are reported in the job log and as
|
|
# a SARIF artifact on the run; code-scanning upload is deliberately disabled
|
|
# so the workflow stays read-only (no security-events: write).
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master]
|
|
paths:
|
|
- 'bun.lock'
|
|
- 'package.json'
|
|
schedule:
|
|
- cron: '30 6 * * 1' # weekly, Monday 06:30 UTC
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
osv-scan:
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
# Required by the reusable workflow's own top-level permissions block —
|
|
# GitHub validates the caller grants a superset AT STARTUP, even with
|
|
# upload-sarif: false (nothing is actually uploaded; see #2117 upstream).
|
|
security-events: write
|
|
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
|
|
with:
|
|
upload-sarif: false
|