a7a1595cbf
- make quick/check/mutation from cj/security-baseline (Makefile unchanged, settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint security rules, Forgejo workflow - tests/security: generic baseline tests plus app config and role tests against createApp() with an in-memory database - extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests - fix gaps found by the tests: reject unknown fields on project create, answer malformed JSON with 400 instead of 500, set nosniff on the API - npm audit fix (next 16.4.1 and others, no high/critical left) - clear ESLint errors, safeFileName without control-character regex - per-project ownership stays an open, documented gap (idorGap -> TODO) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
57 lines
1.8 KiB
YAML
57 lines
1.8 KiB
YAML
# Forgejo Actions: Baseline-Pipeline bei jedem Push.
|
|
# Ziel in der App: .forgejo/workflows/security.yml
|
|
# Voraussetzung: Forgejo-Runner mit Label "docker" und Zugriff auf Docker (für gitleaks/Semgrep/Trivy
|
|
# laufen die Jobs in Containern). Runner möglichst isoliert betreiben, nicht mit Host-Docker-Socket
|
|
# auf dem Produktionshost.
|
|
# UNGEPRÜFT: ob git.jappel.io einen Runner mit Label "docker" hat, war beim Einbau unbekannt.
|
|
# Beim ersten Lauf Logs ansehen und nachziehen.
|
|
name: security-baseline
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
secrets:
|
|
runs-on: docker
|
|
container: ghcr.io/gitleaks/gitleaks:v8.30.1
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- run: gitleaks git . --redact --no-banner $( [ -f .gitleaks.toml ] && echo "-c .gitleaks.toml" )
|
|
|
|
node:
|
|
runs-on: docker
|
|
container: node:24
|
|
env:
|
|
NODE_DIR: .
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Prüfen, ob es ein Node-Projekt gibt
|
|
id: has
|
|
run: if [ -f "$NODE_DIR/package.json" ]; then echo "node=1" >> "$GITHUB_OUTPUT"; fi
|
|
- if: steps.has.outputs.node
|
|
working-directory: ${{ env.NODE_DIR }}
|
|
run: |
|
|
npm ci --no-audit --no-fund
|
|
npm run lint --if-present
|
|
npm run typecheck --if-present
|
|
# tests/circuit-tree.controller.test.ts liest die Standard-Datenbank data/leistungsbilanz.db.
|
|
node scripts/run-migrations.js
|
|
npm test
|
|
npm audit --audit-level=high
|
|
|
|
semgrep:
|
|
runs-on: docker
|
|
container: semgrep/semgrep:1.179.0
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: semgrep scan --config .semgrep --error --metrics=off
|
|
|
|
trivy:
|
|
runs-on: docker
|
|
container: aquasec/trivy:latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: trivy fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --exit-code 1 .
|