🌙 Nightly Security Audit #34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) 2026 SnowdreamTech. All rights reserved. | |
| # Licensed under the MIT License. See LICENSE file in the project root for full license information. | |
| --- | |
| name: "🌙 Nightly Security Audit" | |
| "on": | |
| schedule: | |
| # Run at 00:00 UTC every day | |
| - cron: "0 0 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| issues: write | |
| env: | |
| UNIRTM_LOCKED: 1 | |
| # Opt into Node.js 24 now ahead of GitHub's June 16, 2026 forced migration. | |
| # See: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/ | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "1" | |
| jobs: | |
| audit: | |
| name: "🔍 Full Security Audit" | |
| runs-on: ubuntu-latest | |
| environment: development | |
| timeout-minutes: 120 | |
| steps: | |
| - name: "🔒 Harden Runner" | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| raw.githubusercontent.com:443 | |
| objects.githubusercontent.com:443 | |
| pkg-containers.githubusercontent.com:443 | |
| avatars.githubusercontent.com:443 | |
| github.com:443 | |
| packages.microsoft.com:443 | |
| archive.ubuntu.com:80 | |
| archive.ubuntu.com:443 | |
| security.ubuntu.com:80 | |
| security.ubuntu.com:443 | |
| ports.ubuntu.com:80 | |
| ports.ubuntu.com:443 | |
| keyserver.ubuntu.com:80 | |
| keyserver.ubuntu.com:443 | |
| changelogs.ubuntu.com:80 | |
| changelogs.ubuntu.com:443 | |
| deb.debian.org:80 | |
| deb.debian.org:443 | |
| security.debian.org:80 | |
| security.debian.org:443 | |
| snapshot.debian.org:80 | |
| snapshot.debian.org:443 | |
| dl.rockylinux.org:443 | |
| mirrors.rockylinux.org:443 | |
| mirror.centos.org:443 | |
| vault.centos.org:443 | |
| isv-data.centos.org:443 | |
| mirrorlist.centos.org:80 | |
| mirrorlist.centos.org:443 | |
| cdn.redhat.com:443 | |
| cdn-ubi.redhat.com:443 | |
| access.redhat.com:443 | |
| sso.redhat.com:443 | |
| dl-cdn.alpinelinux.org:443 | |
| registry.npmjs.org:443 | |
| registry.yarnpkg.com:443 | |
| pypi.org:443 | |
| files.pythonhosted.org:443 | |
| proxy.golang.org:443 | |
| sum.golang.org:443 | |
| index.crates.io:443 | |
| static.rust-lang.org:443 | |
| packagist.org:443 | |
| repo.maven.apache.org:443 | |
| golang.org:443 | |
| pkg.go.dev:443 | |
| dl.google.com:443 | |
| rubygems.org:443 | |
| registry.terraform.io:443 | |
| formulae.brew.sh:443 | |
| repo.yarnpkg.com:443 | |
| ghcr.io:443 | |
| production.cloudflare.docker.com:80 | |
| production.cloudflare.docker.com:443 | |
| registry-1.docker.io:443 | |
| auth.docker.io:443 | |
| docker.io:443 | |
| quay.io:443 | |
| cdn.quay.io:443 | |
| docker-images-prod.s3.us-west-2.amazonaws.com:443 | |
| docker-images-prod.s3.us-east-1.amazonaws.com:443 | |
| docker-images-prod.s3.amazonaws.com:443 | |
| s3.amazonaws.com:443 | |
| s3.us-west-2.amazonaws.com:443 | |
| s3.us-east-1.amazonaws.com:443 | |
| osv-vulnerabilities.storage.googleapis.com:443 | |
| api.osv.dev:443 | |
| get.trivy.dev:443 | |
| aquasecurity.github.io:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| oauth2.sigstore.dev:443 | |
| rekor.sigstore.dev:443 | |
| fulcio.sigstore.dev:443 | |
| api.sigstore.dev:443 | |
| - name: "📂 Checkout Repository Code" | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: "⚡ Setup UniRTM" | |
| uses: snowdreamtech/setup-unirtm@cacfb4d739ee46d4a4b2528b02b508df2f560706 # v0.4.0 | |
| with: | |
| unirtm-version: "0.25.0" | |
| install: true | |
| trust: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.WORKFLOW_SECRET || secrets.GITHUB_TOKEN }} | |
| - name: "🛡️ Run Security Audit" | |
| shell: sh | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| UNIRTM_YES: 1 | |
| run: | | |
| # We run unirtm run audit which includes gitleaks, osv-scanner, etc. | |
| unirtm run audit | |
| - name: "🚨 Report Vulnerabilities" | |
| if: failure() | |
| shell: sh | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.WORKFLOW_SECRET || secrets.GITHUB_TOKEN }} | |
| run: | | |
| _TITLE="🚨 Nightly Security Audit Failed: Vulnerabilities Detected" | |
| _BODY="The scheduled nightly security audit detected vulnerabilities or secrets in the codebase. | |
| **Run History:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| Please run \`unirtm run audit\` locally to investigate and fix these issues." | |
| # Check if an open issue with the same title already exists to avoid duplication | |
| _EXISTS=$(gh issue list --search "$_TITLE" --state open --json number --jq ".[0].number") | |
| if [ -z "$_EXISTS" ]; then | |
| gh issue create --title "$_TITLE" --body "$_BODY" --label "security,bug" | |
| else | |
| echo "Issue already exists: #$_EXISTS. Skipping creation." | |
| fi |