fix: send delegation TTLs in seconds #6925
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Audit | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - '**/*.md' | |
| - '.github/workflows/release.yml' | |
| schedule: | |
| # Run weekly on Mondays at 00:00 UTC | |
| - cron: '0 0 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| audit-main: | |
| name: Audit Main Package | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci --no-audit --no-fund | |
| - name: Run npm audit (JSON output for SARIF) | |
| run: | | |
| audit_args=(--package-lock-only --json --fetch-retries=0 --fetch-timeout=30000) | |
| npm audit "${audit_args[@]}" > npm-audit-main.json || true | |
| if jq -e '.error' npm-audit-main.json >/dev/null; then | |
| echo "::warning::Configured npm audit endpoint failed; retrying against registry.npmjs.org" | |
| npm audit "${audit_args[@]}" --registry=https://registry.npmjs.org \ | |
| > npm-audit-main.json || true | |
| fi | |
| - name: Convert npm audit to SARIF | |
| if: always() | |
| run: npx tsx scripts/ci/npm-audit-to-sarif.ts npm-audit-main.json npm-audit-main.sarif | |
| - name: Upload npm audit SARIF to GitHub Security tab | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@f68537f3d8a6955880f700730943f8a754454193 # v4 | |
| with: | |
| sarif_file: npm-audit-main.sarif | |
| category: npm-audit-main | |
| - name: Enforce npm audit (fail on high/critical) | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| if jq -e '.error' npm-audit-main.json >/dev/null; then | |
| echo "::warning::npm audit advisory service unavailable after retries" | |
| test "$EVENT_NAME" = "pull_request" | |
| exit | |
| fi | |
| jq -e ' | |
| (.metadata.vulnerabilities.high == 0) and | |
| (.metadata.vulnerabilities.critical == 0) | |
| ' npm-audit-main.json | |
| audit-docs: | |
| name: Audit Docs Site Package | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: docs-site/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --no-audit --no-fund | |
| working-directory: docs-site | |
| - name: Run npm audit (JSON output for SARIF) | |
| run: | | |
| audit_args=(--package-lock-only --json --fetch-retries=0 --fetch-timeout=30000) | |
| npm audit "${audit_args[@]}" > npm-audit-docs.json || true | |
| if jq -e '.error' npm-audit-docs.json >/dev/null; then | |
| echo "::warning::Configured npm audit endpoint failed; retrying against registry.npmjs.org" | |
| npm audit "${audit_args[@]}" --registry=https://registry.npmjs.org \ | |
| > npm-audit-docs.json || true | |
| fi | |
| working-directory: docs-site | |
| - name: Convert npm audit to SARIF | |
| if: always() | |
| run: npx tsx scripts/ci/npm-audit-to-sarif.ts docs-site/npm-audit-docs.json npm-audit-docs.sarif | |
| - name: Upload npm audit SARIF to GitHub Security tab | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@f68537f3d8a6955880f700730943f8a754454193 # v4 | |
| with: | |
| sarif_file: npm-audit-docs.sarif | |
| category: npm-audit-docs | |
| - name: Enforce npm audit (fail on high/critical) | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| run: | | |
| if jq -e '.error' npm-audit-docs.json >/dev/null; then | |
| echo "::warning::npm audit advisory service unavailable after retries" | |
| test "$EVENT_NAME" = "pull_request" | |
| exit | |
| fi | |
| jq -e ' | |
| (.metadata.vulnerabilities.high == 0) and | |
| (.metadata.vulnerabilities.critical == 0) | |
| ' npm-audit-docs.json | |
| working-directory: docs-site |