chore: snapshot local worktree changes #872
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | ||
|
Check failure on line 1 in .github/workflows/security.yml
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| pull_request: | ||
| branches: [main] | ||
| schedule: | ||
| - cron: '0 8 * * 1' # Weekly Monday 8am UTC | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| go-dependency-audit: | ||
| name: Go Dependency Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/setup-go@v6 | ||
| with: | ||
| go-version-file: go.mod | ||
| - name: Check for known vulnerabilities | ||
| run: | | ||
| go install golang.org/x/vuln/cmd/govulncheck@latest | ||
| govulncheck ./... | ||
| - name: Verify go.sum integrity | ||
| run: go mod verify | ||
| - name: Check for unused dependencies | ||
| run: | | ||
| go mod tidy | ||
| git diff --exit-code go.mod go.sum || (echo "::error::go.mod/go.sum not tidy — run 'go mod tidy'" && exit 1) | ||
| secret-scan: | ||
| name: Secret Detection | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: TruffleHog secret scan | ||
| uses: trufflesecurity/trufflehog@main | ||
| with: | ||
| extra_args: --only-verified | ||
| docker-scan: | ||
| name: Docker Image Scan | ||
| runs-on: ubuntu-latest | ||
| if: hashFiles('Dockerfile') != '' | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - name: Build image | ||
| run: docker build -t tradingagent:scan . | ||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: tradingagent:scan | ||
| format: sarif | ||
| output: trivy-results.sarif | ||
| severity: CRITICAL,HIGH | ||
| - name: Upload Trivy scan results | ||
| uses: github/codeql-action/upload-sarif@v4 | ||
| if: always() | ||
| with: | ||
| sarif_file: trivy-results.sarif | ||
| npm-audit: | ||
| name: Frontend Dependency Audit | ||
| runs-on: ubuntu-latest | ||
| if: hashFiles('web/package-lock.json') != '' | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: 22 | ||
| - name: npm audit | ||
| working-directory: web | ||
| run: npm audit --audit-level=high || true | ||
