fix(panel): key the verdict cache by the full review request (P4) #781
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security-deps | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "packages/**" | |
| - "apps/**" | |
| - "bun.lock" | |
| - "osv-scanner.toml" | |
| - ".github/workflows/security-deps.yml" | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "23 6 * * 1" | |
| concurrency: | |
| group: security-deps-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| scan: | |
| name: dep vuln scan (osv + audit) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| env: | |
| OSV_SCANNER_VERSION: "2.3.8" | |
| OSV_SCANNER_SHA256: "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'packages/**' | |
| - 'apps/**' | |
| - 'bun.lock' | |
| - 'osv-scanner.toml' | |
| - '.github/workflows/security-deps.yml' | |
| - name: Install osv-scanner CLI | |
| if: steps.filter.outputs.code == 'true' | |
| run: | | |
| set -euo pipefail | |
| curl -sSL -o /tmp/osv-scanner \ | |
| "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64" | |
| echo "${OSV_SCANNER_SHA256} /tmp/osv-scanner" | sha256sum -c - | |
| chmod +x /tmp/osv-scanner | |
| sudo mv /tmp/osv-scanner /usr/local/bin/ | |
| osv-scanner --version | |
| - name: Run osv-scanner | |
| if: steps.filter.outputs.code == 'true' | |
| run: | | |
| set +e | |
| osv-scanner \ | |
| --config=osv-scanner.toml \ | |
| --lockfile=bun.lock \ | |
| --format=sarif \ | |
| --output-file=osv-results.sarif | |
| echo "OSV_EXIT=$?" >> "$GITHUB_ENV" | |
| set -e | |
| - name: Upload osv SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@7c1e4cf0b20d7c1872b26569c00ba908797a59bf # v4 | |
| with: | |
| sarif_file: osv-results.sarif | |
| category: osv-scanner | |
| continue-on-error: true | |
| - name: Fail on osv findings | |
| if: steps.filter.outputs.code == 'true' | |
| run: | | |
| if [ ! -f osv-results.sarif ]; then | |
| echo "osv-results.sarif missing: osv-scanner failed to write output." | |
| exit 1 | |
| fi | |
| # osv-scanner EXCLUDES osv-scanner.toml-ignored advisories from its | |
| # output, so any remaining result is an un-accepted finding. | |
| UNFILTERED=$(jq -r '[.runs[].results[]?] | length' osv-results.sarif) | |
| echo "Unfiltered osv-scanner findings: ${UNFILTERED}" | |
| if [ "${UNFILTERED}" != "0" ]; then | |
| echo "osv-scanner reported ${UNFILTERED} unfiltered vulnerabilities. See SARIF in the Security tab." | |
| exit 1 | |
| fi | |
| - name: Set up Bun | |
| if: steps.filter.outputs.code == 'true' | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: bun audit | |
| if: steps.filter.outputs.code == 'true' | |
| # All ignored GHSAs are undici@7.24.8 advisories — accepted-risk: undici | |
| # 7.24.8 reaches us only via wrangler→miniflare (docs-deploy dev dep), | |
| # never the published @agjs/tsforge package (its undici via jsdom is already | |
| # 7.28.0/patched). Mirrors the osv-scanner.toml allowlist; re-evaluate by | |
| # 2026-09-12 / when wrangler bumps undici. (bun audit keys on the GHSA id; | |
| # --audit-level=high means only the high-severity undici GHSAs need listing.) | |
| run: >- | |
| bun audit --audit-level=high | |
| --ignore=GHSA-vmh5-mc38-953g | |
| --ignore=GHSA-hm92-r4w5-c3mj | |
| --ignore=GHSA-vxpw-j846-p89q |