|
59 | 59 | run: yarn coverage |
60 | 60 | if: success() |
61 | 61 |
|
62 | | - audit-ci: |
63 | | - name: Run audit-ci |
64 | | - needs: prebuild |
65 | | - runs-on: ubuntu-latest |
66 | | - steps: |
67 | | - - name: Checkout repo |
68 | | - uses: actions/checkout@v2 |
69 | | - |
70 | | - - name: Install Node.js v12 |
71 | | - uses: actions/setup-node@v2 |
72 | | - with: |
73 | | - node-version: "12" |
74 | | - |
75 | | - - name: Fetch dependencies from cache |
76 | | - id: cache-yarn |
77 | | - uses: actions/cache@v2 |
78 | | - with: |
79 | | - path: "**/node_modules" |
80 | | - key: yarn-build-${{ hashFiles('**/yarn.lock') }} |
81 | | - |
82 | | - - name: Install dependencies |
83 | | - if: steps.cache-yarn.outputs.cache-hit != 'true' |
84 | | - run: yarn --frozen-lockfile |
85 | | - |
86 | | - - name: Audit for vulnerabilities |
87 | | - run: yarn _audit |
88 | | - if: success() |
89 | | - |
90 | 62 | build: |
91 | 63 | name: Build |
92 | 64 | needs: prebuild |
@@ -461,30 +433,3 @@ jobs: |
461 | 433 | uses: github/codeql-action/upload-sarif@v1 |
462 | 434 | with: |
463 | 435 | sarif_file: "trivy-image-results.sarif" |
464 | | - |
465 | | - # We have to use two trivy jobs |
466 | | - # because GitHub only allows |
467 | | - # codeql/upload-sarif action per job |
468 | | - trivy-scan-repo: |
469 | | - runs-on: ubuntu-20.04 |
470 | | - |
471 | | - steps: |
472 | | - - name: Checkout code |
473 | | - uses: actions/checkout@v2 |
474 | | - |
475 | | - - name: Run Trivy vulnerability scanner in repo mode |
476 | | - # Commit SHA for v0.0.14 |
477 | | - uses: aquasecurity/trivy-action@341f810bd602419f966a081da3f4debedc3e5c8e |
478 | | - with: |
479 | | - scan-type: "fs" |
480 | | - scan-ref: "." |
481 | | - ignore-unfixed: true |
482 | | - format: "template" |
483 | | - template: "@/contrib/sarif.tpl" |
484 | | - output: "trivy-repo-results.sarif" |
485 | | - severity: "HIGH,CRITICAL" |
486 | | - |
487 | | - - name: Upload Trivy scan results to GitHub Security tab |
488 | | - uses: github/codeql-action/upload-sarif@v1 |
489 | | - with: |
490 | | - sarif_file: "trivy-repo-results.sarif" |
0 commit comments