[codex] refactor security hardening changes #4

	---
	name: Dependency audit

	on:
	push:
	branches: [main]
	pull_request:
	schedule:
	# 週次でフル依存スキャン（GitHub Advisory DB の更新を反映）
	- cron: '0 8 * * 1'

	jobs:
	python-audit:
	name: pip-audit (apps/api)
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: ./apps/api
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@v4
	- name: Install uv
	uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
	with:
	enable-cache: true
	cache-dependency-glob: apps/api/uv.lock
	- name: Setup Python
	run: uv python install 3.13
	- name: Install dependencies
	run: uv sync --frozen
	- name: Run pip-audit
	# 既存依存の監査結果は warning として出し、修正用の別 PR で段階的に収束させる。
	run: \|
	uv run --with pip-audit pip-audit --strict --vulnerability-service osv \
	--ignore-vuln GHSA-pmw9-67j2-vh2r \|\| \
	echo "::warning::pip-audit found vulnerabilities. Review the output above."

	node-audit:
	name: pnpm audit (apps/reader)
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@v4
	- uses: pnpm/action-setup@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: 'pnpm'
	- name: Install dependencies
	run: pnpm install --frozen-lockfile
	- name: Run pnpm audit (high+)
	# 現状の workspace には既存脆弱性が多数あるため、この PR では監査結果を warning として可視化する。
	run: \|
	pnpm audit --audit-level high \|\| \
	echo "::warning::pnpm audit found high+ vulnerabilities. Review the output above."

Navigation Menu