chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates #256

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	# Weekly scan every Monday at 06:00 UTC
	- cron: "0 6 * * 1"

	permissions:
	contents: read
	security-events: write

	jobs:
	npm-audit:
	name: Dependency audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: "24"
	cache: "npm"
	- run: npm ci
	- name: Audit production dependencies
	run: npm audit --omit=dev --audit-level=high
	continue-on-error: true
	- name: Audit all dependencies (informational)
	run: npm audit --audit-level=critical

	semgrep:
	name: Semgrep SAST
	runs-on: ubuntu-latest
	container:
	image: semgrep/semgrep
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: Run Semgrep
	run: \|
	semgrep scan \
	--config auto \
	--config p/javascript \
	--config p/typescript \
	--config p/nodejs \
	--config p/owasp-top-ten \
	--config p/sql-injection \
	--config p/xss \
	--error \
	--severity ERROR \
	--exclude "v0-prototype" \
	--exclude "node_modules" \
	--exclude "dist" \
	--exclude "*.test.ts" \
	--exclude "*.spec.ts" \
	--sarif --output semgrep-results.sarif \
	.
	env:
	SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
	continue-on-error: true
	- name: Upload SARIF to GitHub Security tab
	uses: github/codeql-action/upload-sarif@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
	if: always()
	with:
	sarif_file: semgrep-results.sarif
	continue-on-error: true

Navigation Menu