Skip to content

Commit d6580f0

Browse files
GenerQAQGenerQAQ
authored
feat(ci): add reusable security scan workflow for Go, Python, and JS/TS audits (#148)
* feat(ci): add reusable security scan workflow for Go, Python, and JS/TS audits * chore(workflows): remove names from security scan workflows for consistency * chore(workflows): update Go version to 1.25.5 in CLI workflows
1 parent e2cb938 commit d6580f0

6 files changed

Lines changed: 99 additions & 124 deletions

File tree

‎.github/workflows/cli-release.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ permissions:
99
contents: write
1010

1111
env:
12-
GO_VERSION: '1.25.1'
12+
GO_VERSION: '1.25.5'
1313

1414
jobs:
1515
create-release:

‎.github/workflows/cli-test.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ on:
1717
- '.github/workflows/cli-test.yaml'
1818

1919
env:
20-
GO_VERSION: '1.25.1'
20+
GO_VERSION: '1.25.5'
2121

2222
jobs:
2323
test:
@@ -28,7 +28,7 @@ jobs:
2828
working-directory: src/client/acontext-cli
2929
strategy:
3030
matrix:
31-
go-version: ['1.25.1']
31+
go-version: ['1.25.5']
3232

3333
steps:
3434
- name: Checkout code
@@ -106,7 +106,7 @@ jobs:
106106
fail-fast: false
107107
matrix:
108108
os: [ubuntu-latest, macos-latest, windows-latest]
109-
go-version: ['1.25.1']
109+
go-version: ['1.25.5']
110110

111111
steps:
112112
- name: Checkout code

‎.github/workflows/security-reusable.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Security Scan (Reusable)
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
go-vulncheck:
8+
name: Go Vulnerability Check
9+
runs-on: ubuntu-latest
10+
strategy:
11+
matrix:
12+
include:
13+
- name: API
14+
path: src/server/api/go
15+
- name: CLI
16+
path: src/client/acontext-cli
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
- name: Setup Go
21+
uses: actions/setup-go@v5
22+
with:
23+
go-version-file: ${{ matrix.path }}/go.mod
24+
cache: true
25+
- name: Run govulncheck on ${{ matrix.name }}
26+
working-directory: ${{ matrix.path }}
27+
run: |
28+
go install golang.org/x/vuln/cmd/govulncheck@latest
29+
govulncheck ./...
30+
31+
python-audit:
32+
name: Python Security Audit
33+
runs-on: ubuntu-latest
34+
steps:
35+
- name: Checkout
36+
uses: actions/checkout@v4
37+
- name: Install uv
38+
uses: astral-sh/setup-uv@v5
39+
- name: Setup Python
40+
uses: actions/setup-python@v5
41+
with:
42+
python-version: '3.12'
43+
- name: Install pip-audit
44+
run: pip install pip-audit
45+
- name: Audit Projects
46+
run: |
47+
for dir in src/server/core src/client/acontext-py; do
48+
echo "🔍 Auditing $dir..."
49+
cd $dir
50+
uv export --format requirements-txt --no-hashes --no-dev > reqs.txt
51+
pip-audit -r reqs.txt
52+
rm reqs.txt
53+
cd - > /dev/null
54+
done
55+
56+
js-audit:
57+
name: JS/TS Security Audit
58+
runs-on: ubuntu-latest
59+
steps:
60+
- name: Checkout
61+
uses: actions/checkout@v4
62+
- name: Setup Node
63+
uses: actions/setup-node@v4
64+
with:
65+
node-version: '20'
66+
- name: Setup pnpm
67+
run: npm install -g pnpm
68+
- name: Audit TS SDK
69+
working-directory: src/client/acontext-ts
70+
run: npm audit --audit-level=high
71+
- name: Audit UI
72+
working-directory: src/server/ui
73+
run: pnpm audit --audit-level=high

‎.github/workflows/security-scan.yaml‎

Lines changed: 18 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -5,79 +5,38 @@ on:
55
branches: [main, dev]
66
paths:
77
- 'src/server/api/go/go.mod'
8+
- 'src/server/api/go/go.sum'
9+
- 'src/client/acontext-cli/go.mod'
10+
- 'src/client/acontext-cli/go.sum'
811
- 'src/server/core/pyproject.toml'
12+
- 'src/server/core/uv.lock'
913
- 'src/client/acontext-py/pyproject.toml'
14+
- 'src/client/acontext-py/uv.lock'
1015
- 'src/client/acontext-ts/package.json'
16+
- 'src/client/acontext-ts/package-lock.json'
1117
- 'src/server/ui/package.json'
18+
- 'src/server/ui/pnpm-lock.yaml'
1219
- '.github/workflows/security-scan.yaml'
20+
- '.github/workflows/security-reusable.yaml'
1321
pull_request:
1422
branches: [main, dev]
1523
paths:
1624
- 'src/server/api/go/go.mod'
25+
- 'src/server/api/go/go.sum'
26+
- 'src/client/acontext-cli/go.mod'
27+
- 'src/client/acontext-cli/go.sum'
1728
- 'src/server/core/pyproject.toml'
29+
- 'src/server/core/uv.lock'
1830
- 'src/client/acontext-py/pyproject.toml'
31+
- 'src/client/acontext-py/uv.lock'
1932
- 'src/client/acontext-ts/package.json'
33+
- 'src/client/acontext-ts/package-lock.json'
2034
- 'src/server/ui/package.json'
35+
- 'src/server/ui/pnpm-lock.yaml'
2136
- '.github/workflows/security-scan.yaml'
37+
- '.github/workflows/security-reusable.yaml'
2238
workflow_dispatch:
2339

2440
jobs:
25-
go-vulncheck:
26-
name: Go Vulnerability Check
27-
runs-on: ubuntu-latest
28-
steps:
29-
- name: Checkout
30-
uses: actions/checkout@v4
31-
- name: Setup Go
32-
uses: actions/setup-go@v5
33-
with:
34-
go-version-file: src/server/api/go/go.mod
35-
cache: true
36-
- name: Run govulncheck
37-
working-directory: src/server/api/go
38-
run: |
39-
go install golang.org/x/vuln/cmd/govulncheck@latest
40-
govulncheck ./...
41-
42-
python-audit:
43-
name: Python Security Audit
44-
runs-on: ubuntu-latest
45-
steps:
46-
- name: Checkout
47-
uses: actions/checkout@v4
48-
- name: Install uv
49-
uses: astral-sh/setup-uv@v5
50-
- name: Setup Python
51-
uses: actions/setup-python@v5
52-
with:
53-
python-version: '3.12'
54-
- name: Install pip-audit
55-
run: pip install pip-audit
56-
- name: Audit Projects
57-
run: |
58-
for dir in src/server/core src/client/acontext-py; do
59-
cd $dir
60-
uv export --format requirements-txt --no-hashes --no-dev > reqs.txt
61-
pip-audit -r reqs.txt
62-
rm reqs.txt
63-
cd - > /dev/null
64-
done
65-
66-
js-audit:
67-
name: JS/TS Security Audit
68-
runs-on: ubuntu-latest
69-
steps:
70-
- name: Checkout
71-
uses: actions/checkout@v4
72-
- name: Setup Node
73-
uses: actions/setup-node@v4
74-
with:
75-
node-version: '20'
76-
- name: Audit TS SDK
77-
working-directory: src/client/acontext-ts
78-
run: npm audit --audit-level=high
79-
- name: Audit UI
80-
working-directory: src/server/ui
81-
run: |
82-
npm install -g pnpm
83-
pnpm audit --audit-level=high
41+
security:
42+
uses: ./.github/workflows/security-reusable.yaml

‎.github/workflows/security-scheduled.yaml‎

Lines changed: 3 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -2,66 +2,9 @@ name: Security Scheduled Scan
22

33
on:
44
schedule:
5-
- cron: '0 0 * * 1'
5+
- cron: '0 0 * * 1' # Every Monday at midnight UTC
66
workflow_dispatch:
77

88
jobs:
9-
go-vulncheck:
10-
name: Go Vulnerability Check
11-
runs-on: ubuntu-latest
12-
steps:
13-
- name: Checkout
14-
uses: actions/checkout@v4
15-
- name: Setup Go
16-
uses: actions/setup-go@v5
17-
with:
18-
go-version-file: src/server/api/go/go.mod
19-
cache: true
20-
- name: Run govulncheck
21-
working-directory: src/server/api/go
22-
run: |
23-
go install golang.org/x/vuln/cmd/govulncheck@latest
24-
govulncheck ./...
25-
26-
python-audit:
27-
name: Python Security Audit
28-
runs-on: ubuntu-latest
29-
steps:
30-
- name: Checkout
31-
uses: actions/checkout@v4
32-
- name: Install uv
33-
uses: astral-sh/setup-uv@v5
34-
- name: Setup Python
35-
uses: actions/setup-python@v5
36-
with:
37-
python-version: '3.12'
38-
- name: Install pip-audit
39-
run: pip install pip-audit
40-
- name: Audit Projects
41-
run: |
42-
for dir in src/server/core src/client/acontext-py; do
43-
cd $dir
44-
uv export --format requirements-txt --no-hashes --no-dev > reqs.txt
45-
pip-audit -r reqs.txt
46-
rm reqs.txt
47-
cd - > /dev/null
48-
done
49-
50-
js-audit:
51-
name: JS/TS Security Audit
52-
runs-on: ubuntu-latest
53-
steps:
54-
- name: Checkout
55-
uses: actions/checkout@v4
56-
- name: Setup Node
57-
uses: actions/setup-node@v4
58-
with:
59-
node-version: '20'
60-
- name: Audit TS SDK
61-
working-directory: src/client/acontext-ts
62-
run: npm audit --audit-level=high
63-
- name: Audit UI
64-
working-directory: src/server/ui
65-
run: |
66-
npm install -g pnpm
67-
pnpm audit --audit-level=high
9+
security:
10+
uses: ./.github/workflows/security-reusable.yaml

‎src/client/acontext-cli/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/memodb-io/Acontext/acontext-cli
22

3-
go 1.25.1
3+
go 1.25.5
44

55
require (
66
github.com/AlecAivazis/survey/v2 v2.3.7

0 commit comments

Comments
 (0)