Skip to content

Add the shared OSV and secret scans beside the local audit #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
imanimanyara merged 1 commit into from
Nov 13, 2026
Merged

Add the shared OSV and secret scans beside the local audit #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,17 @@ jobs:

- name: Composer audit
run: composer audit --no-interaction

# The OSV scan and the secret scan this repository has never had. The local `audit` job above is
# deliberately left alone: it caches composer and pins its own PHP, which the shared workflow does
# not, and its `composer update` audit covers dev dependencies that the shared job's
# `--locked --no-dev` skips. The two are not duplicates; neither is a superset of the other.
shared:
name: shared scans (OSV, secrets)
uses: laranail/.github/.github/workflows/security.yml@main
with:
php-version: '8.5'
php-extensions: 'dom, curl, libxml, mbstring, zip, fileinfo'
# Carries OP_SERVICE_ACCOUNT_TOKEN through for the ggshield step. The shared workflow declares it
# optional and skips with a warning when absent, so this is correct before the credential exists.
secrets: inherit
Loading