feat(routing): add milestone-based fund releases and routing strategies #1070

	name: Security Scan

	on:
	push:
	branches: [ "main", "master" ]
	pull_request:
	branches: [ "main", "master" ]
	schedule:
	- cron: '0 0 * * *'

	# Cancel in-progress runs for the same branch/PR when a new push arrives.
	# Scheduled (nightly) runs are not cancelled.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read
	issues: write
	pull-requests: write

	jobs:
	security-scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Set up Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20"
	cache: "npm"

	- name: Install Dependencies
	run: npm ci

	- name: Run npm audit (Fail on high/critical)
	id: npm_audit
	run: npm audit --audit-level=high

	- name: Run SAST with eslint-plugin-security
	id: sast
	run: npm run lint:security

	- name: Run Gitleaks for secrets scanning
	id: gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Post PR Comment with Scan Results
	uses: actions/github-script@v8
	if: github.event_name == 'pull_request' && failure() && github.event.pull_request.head.repo.full_name == github.repository
	continue-on-error: true
	with:
	github-token: ${{secrets.GITHUB_TOKEN}}
	script: \|
	github.rest.issues.createComment({
	issue_number: context.issue.number,
	owner: context.repo.owner,
	repo: context.repo.repo,
	body: '🚨 Security Scan Failed 🚨\nOne or more security checks have failed. Please check the CI logs for details regarding SAST, Secrets, or Dependency Vulnerabilities.'
	})

Navigation Menu