docs(inertia): cover Config.Head in the inline reference #192

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "0 6 * * 1" # weekly Monday 06:00 UTC, catches newly-disclosed CVEs

	permissions:
	contents: read
	security-events: write # needed for gosec SARIF upload

	jobs:
	govulncheck:
	name: govulncheck
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	go-version: "stable"
	- name: Run govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	govulncheck ./...

	gosec:
	name: gosec
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-go@v5
	with:
	go-version: "stable"
	- name: Run gosec
	uses: securego/gosec@master
	with:
	# G104: unchecked Close()/Remove() — noisy and rarely actionable for
	# fire-and-forget cleanup paths.
	# G204: subprocess launched with variable — every site is a CLI helper
	# (nexus dev, nexus add) launching `go run`, `npm`, `open <url>`
	# with operator-supplied args. Not server-side input.
	# G301/G302/G306: file/dir permission rules — the dep cache under
	# ~/.nexus/ needs to be user-writable; tightening these would
	# break the tool. CLI-only.
	# G304: file inclusion via variable — every site is a dev tool
	# reading operator-supplied paths (frontend dir, project root,
	# vite config). Server-side framework code never does this.
	args: "-no-fail -fmt sarif -out results.sarif -exclude=G104,G204,G301,G302,G304,G306 ./..."
	- name: Upload SARIF to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: results.sarif

Navigation Menu