Bump github.com/lib/pq from 1.10.9 to 1.11.1 in /api #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| schedule: | |
| - cron: '0 0 * * 0' # Weekly on Sunday | |
| jobs: | |
| secrets-scan: | |
| name: Secrets Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run TruffleHog | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| dependency-scan: | |
| name: Dependency Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.24' | |
| - name: Run Gosec Security Scanner | |
| uses: securego/gosec@master | |
| with: | |
| args: '-no-fail -fmt json -out gosec-report.json ./api/...' | |
| continue-on-error: true | |
| - name: Upload Gosec results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: gosec-report | |
| path: gosec-report.json | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Run npm audit | |
| working-directory: ./frontend | |
| run: npm audit --audit-level=moderate || true | |
| - name: Run Snyk | |
| uses: snyk/actions/node@master | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: --severity-threshold=high | |
| continue-on-error: true | |
| sbom-generation: | |
| name: SBOM Generation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Generate Go SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| path: ./api | |
| format: spdx-json | |
| output-file: go-sbom.spdx.json | |
| - name: Generate Node.js SBOM | |
| working-directory: ./frontend | |
| run: | | |
| npm install -g @cyclonedx/cyclonedx-npm | |
| cyclonedx-npm --output-file node-sbom.json | |
| - name: Upload SBOMs | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sboms | |
| path: | | |
| go-sbom.spdx.json | |
| frontend/node-sbom.json | |
| signed-builds: | |
| name: Signed Builds | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'release' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.24' | |
| - name: Build binary | |
| working-directory: ./api | |
| run: go build -o neuronip-api cmd/server/main.go | |
| - name: Sign binary | |
| run: | | |
| # In production, use proper code signing | |
| # For now, generate checksums | |
| sha256sum neuronip-api > neuronip-api.sha256 | |
| - name: Upload signed artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: signed-binaries | |
| path: | | |
| neuronip-api | |
| neuronip-api.sha256 |