mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
22402e89de
* feat: add dependency management with Renovate, uv.lock, and security scanning Adds automated dependency update detection and vulnerability scanning across all dependency layers (Python, vendored JS, TypeScript SDK, Docker, GitHub Actions). - Renovate config with 10 package groups and custom regex managers for vendored JS (KaTeX, Highlight.js, Mermaid) tracking via npm registry - uv.lock for reproducible builds (80 packages) - Dockerfile switched to uv sync --frozen with layer caching - CI: pip-audit (via lock file), npm audit, lock-check jobs - CI: lint job uses pre-commit for ruff version consistency - Docker security scan workflow (weekly Trivy, HIGH/CRITICAL) - Helper script for vendored JS library updates * fix: resolve CI failures and address review feedback - Update pre-commit hooks: ruff v0.9.10 -> v0.15.6 (fixes deprecated UP038 rule), mypy v1.14.1 -> v1.19.1 - Add per-file-ignore for N802 on sandbox.py (ast visitor convention) - Fix pip-audit: install into uv venv so uv run can find it - Pin uv-version in CI to match lock file generator (0.9.18) - Upgrade vitest ^2.0 -> ^4.1 to fix esbuild GHSA-67mh-4wv8-2f99 - Vendored JS script: use grep -rl for auto-discovery of version refs (catches docs/architecture.md), fix LICENSE comment, portable grep
23 lines
448 B
YAML
23 lines
448 B
YAML
name: Docker Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
- cron: "0 6 * * 1" # Weekly Monday 06:00 UTC
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: docker build -t turnstone:scan .
|
|
- uses: aquasecurity/trivy-action@0.30.0
|
|
with:
|
|
image-ref: "turnstone:scan"
|
|
severity: "HIGH,CRITICAL"
|
|
exit-code: "1"
|