Normalize GHCR image names #10

	name: security

	on:
	push:
	pull_request:
	schedule:
	- cron: "17 4 * * 1"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	python:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: actions/setup-python@v6
	with:
	python-version: "3.13"
	- run: python -m pip install -e ".[platform,charts]" pip-audit bandit
	- run: pip-audit
	- run: bandit -q -r src -x tests

	javascript:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: actions/setup-node@v6
	with:
	node-version: "22"
	cache: npm
	cache-dependency-path: \|
	web/package-lock.json
	clients/typescript/package-lock.json
	- run: npm ci
	working-directory: web
	- run: npm audit --audit-level=high
	working-directory: web
	- run: npm ci
	working-directory: clients/typescript
	- run: npm audit --audit-level=high
	working-directory: clients/typescript

	secrets:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	with:
	fetch-depth: 0
	- uses: gitleaks/gitleaks-action@v3
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	trivy:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: aquasecurity/trivy-action@v0.36.0
	with:
	scan-type: fs
	scan-ref: .
	severity: HIGH,CRITICAL
	ignore-unfixed: true
	exit-code: "1"
	- run: docker build --tag aix-open:${{ github.sha }} .
	- uses: aquasecurity/trivy-action@v0.36.0
	with:
	image-ref: aix-open:${{ github.sha }}
	severity: HIGH,CRITICAL
	ignore-unfixed: true
	exit-code: "1"

Navigation Menu