Skip to content

fix: package.json & yarn.lock to reduce vulnerabilities #138

fix: package.json & yarn.lock to reduce vulnerabilities

fix: package.json & yarn.lock to reduce vulnerabilities #138

Workflow file for this run

---
name: Security scan of code base
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# GitHub Actions Documentation
# https://docs.github.com/en/github-ae@latest/actions
on:
# Run on all pushes (except on master/main branch)
push:
branches-ignore: [master, main]
# Remove the line above to run when pushing to master
# PRs on master/main branch
pull_request:
branches: [master, main]
# on button click
workflow_dispatch:
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_dispatchinputs
inputs:
ref:
# The branch, tag or SHA to checkout for linting. If empty, check out
# the repository that triggered the workflow.
description: |
The branch, tag or SHA to checkout (empty for current branch)
required: false
type: string
# or on calling as reusable workflow
workflow_call:
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callinputs
inputs:
ref:
# The branch, tag or SHA to checkout for linting. If empty, check out
# the repository that triggered the workflow.
description: |
The branch, tag or SHA to checkout (empty for current branch)
required: false
type: string
jobs:
scan:
name: Scan code base
runs-on: ubuntu-latest
# Grant permissions
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: ['javascript']
# CodeQL also supports ['cpp','csharp','go','java','python','ruby']
# Learn more about CodeQL language support at
# https://aka.ms/codeql-docs/language-support
steps:
# Checkout a repository, so the workflow can access it
# https://github.com/actions/checkout
-
name: Checkout repository (no ref input)
uses: actions/checkout@v4
if: ${{ inputs.ref == '' }}
with:
# Only a single commit is fetched by default, for the ref/SHA that
# triggered the workflow. Set fetch-depth: 0 to fetch all history
# for all branches and tags.
fetch-depth: 0
-
name: Checkout repository (with ref input)
uses: actions/checkout@v4
if: ${{ inputs.ref != '' }}
with:
ref: '${{ inputs.ref }}'
# Only a single commit is fetched by default, for the ref/SHA that
# triggered the workflow. Set fetch-depth: 0 to fetch all history
# for all branches and tags.
fetch-depth: 0
# Initialize the CodeQL tools for scanning
# https://github.com/github/codeql-action
-
name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a
# config file. By default, queries listed here will override any
# specified in a config file. Prefix the list here with "+" to use
# these queries and those in the config file.
# Details on CodeQL's query packs refer to:
# https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality
# Autobuild attempts to build any compiled languages (C/C++, C#, or
# Java). If this step fails, then you should remove it and run the build
# manually (see below).
-
name: Autobuild
uses: github/codeql-action/autobuild@v3
# ℹ️ Command-line programs to run using the OS shell
# 📚 See
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
# If the Autobuild fails above, remove it and uncomment the following
# three lines. Modify them (or add more) to build your code if your
# project, please refer to the EXAMPLE below for guidance.
# -
# run: |
# echo "Run, Build Application using script"
# ./location_of_script_within_repo/buildscript.sh
-
name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3