Security #91
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| # PR-time security gates for dish-linux. Pulls the shared jobs from | |
| # this repo's local copy of `_security.yml` (action-pin lint, allowlist- | |
| # expiry, OSV-Scanner, dependency-review, gitleaks). CodeQL lives in | |
| # codeql.yml because it has its own matrix. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 6 * * 1" # weekly Monday 06:00 UTC | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| security-events: write | |
| jobs: | |
| shared: | |
| uses: ./.github/workflows/_security.yml | |
| with: | |
| # dish-linux uses Qt6 + SDL2 from system packages and no vendored | |
| # source trees, so OSV-Scanner has nothing C++ specific to chew | |
| # on. Scan the worktree for any package manifests OSV recognises | |
| # (Gradle wrappers, CMake fetch declarations, etc.). | |
| osv_scan_paths: | | |
| . | |
| gitleaks_enabled: true | |
| dependency_review_enabled: true | |
| action_pin_lint_enabled: true | |
| allowlist_expiry_enabled: true |