6023ebf9d0
- Custom SQLite task manager replacing TickTick wrapper - 73 tasks migrated from TickTick across 15 projects - RRULE recurrence engine with lazy materialization - Dashboard tasks widget (desktop sidebar + mobile card) - Tasks page with project tabs, add/edit/complete/delete - Security: locked ports to localhost, removed old containers - Gitea Actions runner configured and all 3 CI jobs passing - Fixed mobile overflow on dashboard cards - iOS Capacitor app shell (Second Brain) - Frontend/backend guide docs for adding new services - TickTick Google Calendar sync re-authorized Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
83 lines
2.5 KiB
YAML
83 lines
2.5 KiB
YAML
name: Security Checks
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
dependency-audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Audit Budget dependencies
|
|
working-directory: services/budget
|
|
run: |
|
|
npm ci --production
|
|
npm audit --audit-level=high
|
|
|
|
- name: Audit Frontend dependencies
|
|
working-directory: frontend-v2
|
|
run: |
|
|
npm ci
|
|
npm audit --audit-level=high || true # low-severity OK for now
|
|
|
|
secret-scanning:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Check for secrets in tracked files
|
|
run: |
|
|
echo "Checking for tracked .env files..."
|
|
if git ls-files | grep -E '\.env$' | grep -v '.env.example'; then
|
|
echo "ERROR: .env files are tracked in git!"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Checking for tracked .db files..."
|
|
if git ls-files | grep -E '\.db$'; then
|
|
echo "ERROR: .db files are tracked in git!"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Checking for hardcoded secrets patterns..."
|
|
if grep -rn 'password.*=.*["\x27][a-zA-Z0-9_-]\{8,\}["\x27]' \
|
|
--include='*.py' --include='*.js' --include='*.ts' \
|
|
gateway/ services/ frontend-v2/src/ \
|
|
| grep -v 'env\.\|environ\|process\.env\|\.get(\|config\.\|test\|example\|placeholder\|CHANGE_ME\|changeme' \
|
|
| grep -vi 'hash\|bcrypt\|comment\|error\|warning'; then
|
|
echo "WARNING: Possible hardcoded secrets found (review above)"
|
|
fi
|
|
|
|
echo "Secret scan passed"
|
|
|
|
dockerfile-lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Check Dockerfiles run as non-root
|
|
run: |
|
|
fail=0
|
|
for f in gateway/Dockerfile services/trips/Dockerfile services/fitness/Dockerfile.backend services/inventory/Dockerfile services/budget/Dockerfile frontend-v2/Dockerfile; do
|
|
if [ -f "$f" ]; then
|
|
if ! grep -q '^USER ' "$f"; then
|
|
echo "ERROR: $f does not have a USER instruction (runs as root)"
|
|
fail=1
|
|
fi
|
|
if ! grep -q 'HEALTHCHECK' "$f"; then
|
|
echo "WARNING: $f has no HEALTHCHECK"
|
|
fi
|
|
fi
|
|
done
|
|
exit $fail
|