Skip to content

Commit b7fab01

Browse files
ZoneMixZoneMix
committed
ci: add GitHub Actions workflows for security and build automation
1 parent 3bf14af commit b7fab01

File tree

3 files changed

+324
-0
lines changed

3 files changed

+324
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for npm
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
labels:
12+
- "dependencies"
13+
- "security"
14+
# Group minor and patch updates together
15+
groups:
16+
development-dependencies:
17+
dependency-type: "development"
18+
update-types:
19+
- "minor"
20+
- "patch"
21+
production-dependencies:
22+
dependency-type: "production"
23+
update-types:
24+
- "minor"
25+
- "patch"
26+
# Always create PR for major version bumps and security updates
27+
versioning-strategy: increase
28+
29+
# Enable version updates for GitHub Actions
30+
- package-ecosystem: "github-actions"
31+
directory: "/"
32+
schedule:
33+
interval: "weekly"
34+
labels:
35+
- "dependencies"
36+
- "github-actions"

‎.github/workflows/ci.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: CI
2+
3+
on:
4+
pull_request:
5+
branches: [ main, develop ]
6+
push:
7+
branches: [ main, develop ]
8+
9+
jobs:
10+
build-and-test:
11+
name: Build and Test
12+
runs-on: ubuntu-latest
13+
14+
strategy:
15+
matrix:
16+
node-version: [22.x]
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
22+
- name: Setup Node.js ${{ matrix.node-version }}
23+
uses: actions/setup-node@v4
24+
with:
25+
node-version: ${{ matrix.node-version }}
26+
cache: 'npm'
27+
28+
- name: Install dependencies
29+
run: npm ci
30+
31+
- name: Run linter
32+
run: npm run lint
33+
continue-on-error: true
34+
35+
- name: Build check
36+
run: |
37+
echo "Checking for syntax errors..."
38+
node -c src/server.js
39+
node -c src/auth/jwt.js
40+
node -c src/auth/user.js
41+
42+
# Future: Add actual tests here
43+
# - name: Run tests
44+
# run: npm test
45+
46+
- name: Check for security vulnerabilities
47+
run: npm audit --audit-level=high --omit=dev
48+
49+
docker-build:
50+
name: Docker Build Test
51+
runs-on: ubuntu-latest
52+
53+
steps:
54+
- name: Checkout code
55+
uses: actions/checkout@v4
56+
57+
- name: Set up Docker Buildx
58+
uses: docker/setup-buildx-action@v3
59+
60+
- name: Build Docker image
61+
uses: docker/build-push-action@v5
62+
with:
63+
context: .
64+
file: ./Dockerfile
65+
push: false
66+
tags: budget-automation:test
67+
cache-from: type=gha
68+
cache-to: type=gha,mode=max
69+
70+
- name: Test Docker image
71+
run: |
72+
docker run --rm budget-automation:test node -c src/server.js

‎.github/workflows/security.yml‎

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
name: Security Checks
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
schedule:
8+
- cron: '0 0 * * 0' # Weekly vulnerability scan
9+
10+
permissions:
11+
contents: read
12+
security-events: write
13+
pull-requests: write
14+
15+
jobs:
16+
npm-audit:
17+
name: NPM Dependency Audit
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
23+
- name: Setup Node.js
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: '22'
27+
cache: 'npm'
28+
29+
- name: Install dependencies
30+
run: npm ci
31+
32+
- name: Run npm audit
33+
run: npm audit --audit-level=moderate
34+
continue-on-error: true
35+
36+
- name: Check for fixable vulnerabilities
37+
run: npm audit fix --dry-run
38+
continue-on-error: true
39+
40+
snyk-scan:
41+
name: Snyk Vulnerability Scan
42+
runs-on: ubuntu-latest
43+
steps:
44+
- name: Checkout code
45+
uses: actions/checkout@v4
46+
47+
- name: Run Snyk scan
48+
uses: snyk/actions/node@master
49+
env:
50+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
51+
continue-on-error: true
52+
53+
container-scan:
54+
name: Container Image Security Scan
55+
runs-on: ubuntu-latest
56+
steps:
57+
- name: Checkout code
58+
uses: actions/checkout@v4
59+
60+
- name: Set up Docker Buildx
61+
uses: docker/setup-buildx-action@v3
62+
63+
- name: Build Docker image
64+
uses: docker/build-push-action@v5
65+
with:
66+
context: .
67+
file: ./Dockerfile
68+
tags: budget-api:scan
69+
load: true
70+
cache-from: type=gha
71+
cache-to: type=gha,mode=max
72+
73+
- name: Run Trivy vulnerability scan
74+
uses: aquasecurity/trivy-action@master
75+
with:
76+
image-ref: budget-api:scan
77+
format: 'sarif'
78+
output: 'trivy-results.sarif'
79+
80+
- name: Upload Trivy results to GitHub Security
81+
uses: github/codeql-action/upload-sarif@v3
82+
if: always()
83+
with:
84+
sarif_file: 'trivy-results.sarif'
85+
category: 'trivy'
86+
87+
secret-scan:
88+
name: Secret & Credential Detection
89+
runs-on: ubuntu-latest
90+
steps:
91+
- name: Checkout code
92+
uses: actions/checkout@v4
93+
with:
94+
fetch-depth: 0
95+
96+
- name: Run gitleaks scan
97+
uses: gitleaks/gitleaks-action@v2
98+
env:
99+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
100+
101+
eslint:
102+
name: ESLint Code Quality
103+
runs-on: ubuntu-latest
104+
steps:
105+
- name: Checkout code
106+
uses: actions/checkout@v4
107+
108+
- name: Setup Node.js
109+
uses: actions/setup-node@v4
110+
with:
111+
node-version: '22'
112+
cache: 'npm'
113+
114+
- name: Install dependencies
115+
run: npm ci
116+
117+
- name: Run ESLint
118+
run: npx eslint src --max-warnings 0 --format json --output-file eslint-report.json || true
119+
continue-on-error: true
120+
121+
- name: Comment on PR with ESLint results
122+
if: github.event_name == 'pull_request'
123+
uses: actions/github-script@v7
124+
with:
125+
script: |
126+
const fs = require('fs');
127+
const report = JSON.parse(fs.readFileSync('eslint-report.json', 'utf8'));
128+
const issues = report.filter(f => f.messages.length > 0);
129+
if (issues.length > 0) {
130+
let comment = '## ESLint Issues\n\n';
131+
issues.forEach(file => {
132+
comment += `### ${file.filePath}\n`;
133+
file.messages.forEach(msg => {
134+
comment += `- Line ${msg.line}: ${msg.message} (${msg.severity})\n`;
135+
});
136+
});
137+
github.rest.issues.createComment({
138+
issue_number: context.issue.number,
139+
owner: context.repo.owner,
140+
repo: context.repo.repo,
141+
body: comment
142+
});
143+
}
144+
145+
docker-build:
146+
name: Docker Build Test
147+
runs-on: ubuntu-latest
148+
steps:
149+
- name: Checkout code
150+
uses: actions/checkout@v4
151+
152+
- name: Set up Docker Buildx
153+
uses: docker/setup-buildx-action@v3
154+
155+
- name: Build Docker image
156+
uses: docker/build-push-action@v5
157+
with:
158+
context: .
159+
file: ./Dockerfile
160+
tags: budget-api:test
161+
cache-from: type=gha
162+
cache-to: type=gha,mode=max
163+
164+
dependency-check:
165+
name: OWASP Dependency-Check
166+
runs-on: ubuntu-latest
167+
steps:
168+
- name: Checkout code
169+
uses: actions/checkout@v4
170+
171+
- name: Run OWASP Dependency-Check
172+
uses: dependency-check/Dependency-Check_Action@main
173+
with:
174+
project: 'budget-automation'
175+
path: '.'
176+
format: 'JSON'
177+
args: >
178+
--enable-retired
179+
180+
- name: Upload Dependency-Check results
181+
uses: github/codeql-action/upload-sarif@v3
182+
if: always()
183+
with:
184+
sarif_file: 'dependency-check-report.sarif'
185+
category: 'dependency-check'
186+
187+
license-check:
188+
name: License Compliance
189+
runs-on: ubuntu-latest
190+
steps:
191+
- name: Checkout code
192+
uses: actions/checkout@v4
193+
194+
- name: Setup Node.js
195+
uses: actions/setup-node@v4
196+
with:
197+
node-version: '22'
198+
cache: 'npm'
199+
200+
- name: Install dependencies
201+
run: npm ci
202+
203+
- name: Check licenses
204+
run: npx license-checker --onlyunknown
205+
continue-on-error: true
206+
207+
summary:
208+
name: Security Summary
209+
runs-on: ubuntu-latest
210+
needs: [npm-audit, snyk-scan, container-scan, secret-scan, eslint, docker-build]
211+
if: always()
212+
steps:
213+
- name: Check security status
214+
run: |
215+
echo "Security checks completed!"
216+
echo "Review the results above for any issues."

0 commit comments

Comments
 (0)