build(deps): bump the androidx group with 5 updates #54
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Do not add jobs.<id>.environment — Environments block Release Please bot PRs | |
| # (ACTION_REQUIRED) and stall auto-merge. github-pages is Pages-only. | |
| jobs: | |
| trivy: | |
| name: Trivy FS Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| severity: CRITICAL,HIGH | |
| exit-code: "1" | |
| gitleaks: | |
| name: Gitleaks Secret Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Repo-root .gitleaks.toml is the fixture baseline (allowlisted sanitizer JSON). | |
| semgrep: | |
| name: Semgrep FOSS | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Install Semgrep | |
| run: | | |
| python3 -m pip install --user semgrep | |
| echo "${HOME}/.local/bin" >> "${GITHUB_PATH}" | |
| - name: Scan FOSS rules (no SaaS) | |
| run: semgrep --config .semgrep.yml --metrics=off --error | |
| env: | |
| SEMGREP_SEND_METRICS: "off" | |
| security-ok: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| if: ${{ always() && !cancelled() }} | |
| needs: [trivy, gitleaks, semgrep] | |
| steps: | |
| - name: Require scan jobs | |
| run: | | |
| test "${{ needs.trivy.result }}" = "success" | |
| test "${{ needs.gitleaks.result }}" = "success" | |
| test "${{ needs.semgrep.result }}" = "success" |