Skip to content

Commit 5123443

Browse files
fergusbissetfergusbisset
committed
2 parents cf970ab + 1036890 commit 5123443

File tree

11 files changed

+2085
-1239
lines changed

11 files changed

+2085
-1239
lines changed

‎.github/dependabot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for npm
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
# Limit number of open PRs to avoid overwhelming maintainers
11+
open-pull-requests-limit: 10
12+
# Add labels for easy filtering
13+
labels:
14+
- "dependencies"
15+
- "automated"
16+
# Group minor and patch updates together to reduce PR noise
17+
groups:
18+
development-dependencies:
19+
dependency-type: "development"
20+
update-types:
21+
- "minor"
22+
- "patch"
23+
production-dependencies:
24+
dependency-type: "production"
25+
update-types:
26+
- "patch"
27+
# Assign PRs to maintainer
28+
assignees:
29+
- "fergusbisset"
30+
# Increase pull request limit for security updates
31+
# Security updates are always created separately
32+
versioning-strategy: increase
33+
# Allow Dependabot to rebase PRs
34+
rebase-strategy: "auto"
35+
36+
# Monitor GitHub Actions for updates
37+
- package-ecosystem: "github-actions"
38+
directory: "/"
39+
schedule:
40+
interval: "weekly"
41+
day: "monday"
42+
labels:
43+
- "dependencies"
44+
- "github-actions"
45+
assignees:
46+
- "fergusbisset"

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ jobs:
2626
runs-on: ubuntu-latest
2727
steps:
2828
- name: Checkout
29-
uses: actions/checkout@v4
29+
uses: actions/checkout@v6
3030

3131
- name: Setup Node
32-
uses: actions/setup-node@v4
32+
uses: actions/setup-node@v6
3333
with:
3434
node-version: 20
3535
registry-url: https://npm.pkg.github.com

‎.github/workflows/security.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: Security Scanning
2+
3+
on:
4+
push:
5+
branches: [ main, master ]
6+
pull_request:
7+
branches: [ main, master ]
8+
schedule:
9+
# Run security scan every Monday at 9am UTC
10+
- cron: '0 9 * * 1'
11+
workflow_dispatch:
12+
13+
jobs:
14+
npm-audit:
15+
name: NPM Security Audit
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v6
21+
22+
- name: Setup Node.js
23+
uses: actions/setup-node@v6
24+
with:
25+
node-version: '20'
26+
cache: 'npm'
27+
28+
- name: Install dependencies
29+
run: npm ci
30+
31+
- name: Run npm audit
32+
run: |
33+
echo "## NPM Security Audit Results" >> $GITHUB_STEP_SUMMARY
34+
echo "" >> $GITHUB_STEP_SUMMARY
35+
36+
# Run audit and capture output
37+
if npm audit --audit-level=moderate 2>&1 | tee audit.txt; then
38+
echo "✅ No vulnerabilities found!" >> $GITHUB_STEP_SUMMARY
39+
else
40+
echo "⚠️ Vulnerabilities detected - see details below" >> $GITHUB_STEP_SUMMARY
41+
echo "" >> $GITHUB_STEP_SUMMARY
42+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
43+
cat audit.txt >> $GITHUB_STEP_SUMMARY
44+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
45+
exit 1
46+
fi
47+
48+
- name: Check for outdated dependencies
49+
run: |
50+
echo "## Outdated Dependencies" >> $GITHUB_STEP_SUMMARY
51+
echo "" >> $GITHUB_STEP_SUMMARY
52+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
53+
npm outdated >> $GITHUB_STEP_SUMMARY || true
54+
echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
55+
continue-on-error: true
56+
57+
codeql:
58+
name: CodeQL Security Analysis
59+
runs-on: ubuntu-latest
60+
permissions:
61+
security-events: write
62+
actions: read
63+
contents: read
64+
65+
strategy:
66+
fail-fast: false
67+
matrix:
68+
language: [ 'javascript' ]
69+
70+
steps:
71+
- name: Checkout code
72+
uses: actions/checkout@v6
73+
74+
- name: Initialize CodeQL
75+
uses: github/codeql-action/init@v4
76+
with:
77+
languages: ${{ matrix.language }}
78+
# Optional: Add custom queries
79+
# queries: security-extended,security-and-quality
80+
81+
- name: Autobuild
82+
uses: github/codeql-action/autobuild@v4
83+
84+
- name: Perform CodeQL Analysis
85+
uses: github/codeql-action/analyze@v4
86+
with:
87+
category: "/language:${{matrix.language}}"
88+
89+
dependency-review:
90+
name: Dependency Review
91+
runs-on: ubuntu-latest
92+
# Only run on pull requests
93+
if: github.event_name == 'pull_request'
94+
95+
steps:
96+
- name: Checkout code
97+
uses: actions/checkout@v6
98+
99+
- name: Dependency Review
100+
uses: actions/dependency-review-action@v4
101+
with:
102+
# Fail the build if vulnerabilities are found
103+
fail-on-severity: moderate
104+
# Add comment to PR with results
105+
comment-summary-in-pr: always

‎.github/workflows/spc-exports-snapshot.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ jobs:
1414
runs-on: ubuntu-latest
1515
timeout-minutes: 10
1616
steps:
17-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@v6
1818
- name: Setup Node
19-
uses: actions/setup-node@v4
19+
uses: actions/setup-node@v6
2020
with:
2121
node-version: 22
2222
cache: 'npm'

‎.github/workflows/spc-parity.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ jobs:
2121
timeout-minutes: 10
2222
continue-on-error: true # Allow-fail initially; tighten later
2323
steps:
24-
- uses: actions/checkout@v4
24+
- uses: actions/checkout@v6
2525
- name: Setup Node
26-
uses: actions/setup-node@v4
26+
uses: actions/setup-node@v6
2727
with:
2828
node-version: 22
2929
cache: 'npm'

‎.github/workflows/spc-publish.yml‎

Lines changed: 0 additions & 50 deletions
This file was deleted.

‎.github/workflows/spc-validate.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ jobs:
2020
runs-on: ubuntu-latest
2121
timeout-minutes: 15
2222
steps:
23-
- uses: actions/checkout@v4
23+
- uses: actions/checkout@v6
2424
- name: Setup Node
25-
uses: actions/setup-node@v4
25+
uses: actions/setup-node@v6
2626
with:
2727
node-version: 22
2828
cache: 'npm'

‎.github/workflows/visual-testing.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616

1717
steps:
1818
- name: Checkout code
19-
uses: actions/checkout@v4
19+
uses: actions/checkout@v6
2020
with:
2121
fetch-depth: 0
2222

2323
- name: Setup Node.js
24-
uses: actions/setup-node@v4
24+
uses: actions/setup-node@v6
2525
with:
2626
node-version: '24'
2727
cache: 'npm'
@@ -44,7 +44,7 @@ jobs:
4444
run: npm run test:ssr-components
4545

4646
- name: Publish to Chromatic
47-
uses: chromaui/action@v1
47+
uses: chromaui/action@v13
4848
with:
4949
projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
5050
buildScriptName: build-storybook
@@ -54,7 +54,7 @@ jobs:
5454
5555
- name: Upload multi-render logs and reports (always)
5656
if: always()
57-
uses: actions/upload-artifact@v4
57+
uses: actions/upload-artifact@v5
5858
with:
5959
name: multi-render-artifacts
6060
if-no-files-found: ignore

0 commit comments

Comments
 (0)