chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 (#435) #642
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 6 * * 1' # Weekly Monday at 06:00 UTC | |
| jobs: | |
| snyk-go: | |
| name: Snyk Go | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Run Snyk to check for Go vulnerabilities | |
| uses: snyk/actions/golang@9adf32b1121593767fc3c057af55b55db032dc04 # master | |
| continue-on-error: true | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: --severity-threshold=high | |
| snyk-node: | |
| name: Snyk Node | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version: '26' | |
| cache: 'npm' | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| working-directory: web | |
| - name: Run Snyk to check for Node vulnerabilities | |
| uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # master | |
| continue-on-error: true | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: --severity-threshold=high --file=web/package-lock.json | |
| snyk-docker: | |
| name: Snyk Docker | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Build Docker image | |
| run: docker build -t muximux:test . | |
| - name: Run Snyk to check Docker image | |
| uses: snyk/actions/docker@9adf32b1121593767fc3c057af55b55db032dc04 # master | |
| continue-on-error: true | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| image: muximux:test | |
| args: --severity-threshold=high | |
| govulncheck: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Install govulncheck | |
| # SHA-pinned to v1.1.4 (commit d1f3801) so the install is | |
| # cryptographically reproducible. SonarCloud workflows rule | |
| # (S6386 / "Dependency versions are not predictable") only | |
| # accepts commit SHAs, not version tags. Bump deliberately | |
| # via Dependabot or a manual workflow PR. | |
| run: go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 # v1.1.4 | |
| - name: Run govulncheck | |
| # This step gates the workflow. It was continue-on-error while | |
| # GO-2026-4923 (a disputed bbolt CVE) was open; that report was | |
| # withdrawn on 2026-04-08, and the exemption had since been hiding | |
| # two real stdlib findings (GO-2026-6218, GO-2026-6091). | |
| run: govulncheck ./... |