Skip to content
Security

fix(signing): assert the commit object, not local verification #435

Sign in to view logs

fix(signing): assert the commit object, not local verification

fix(signing): assert the commit object, not local verification #435

Workflow file for this run

.github/workflows/security.yml at 0f7c8be
name: Security
# Aggregated security scans for skill repos:
# gitleaks — secret scanning. The job and the reusable keep the
# historical `gitleaks` name; the scan itself runs
# betterleaks, which is OSS and needs no license.
# zizmor — static analysis of this repo's own workflows.
# dependency-review — on pull requests only.
# composer-audit — `composer audit` AND an Opengrep SAST scan; the called
# reusable runs both unless skip-opengrep is set. Every
# skill repo ships a composer.json for split-licensing /
# Packagist distribution.
#
# Top-level `permissions: {}` denies everything by default; each reusable
# caller job re-declares the exact union its reusable's jobs require, so the
# token passed to each reusable is fully explicit and never relies on the
# repo default. This is the same pattern proven in netresearch/.github's
# go-app template (top {} + per-job security-events: write).
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions: {}
jobs:
gitleaks:
uses: netresearch/.github/.github/workflows/gitleaks.yml@main
permissions:
contents: read
security-events: write
zizmor:
uses: netresearch/.github/.github/workflows/zizmor.yml@main
permissions:
contents: read
security-events: write
dependency-review:
if: github.event_name == 'pull_request'
uses: netresearch/.github/.github/workflows/dependency-review.yml@main
permissions:
contents: read
pull-requests: write
composer-audit:
uses: netresearch/typo3-ci-workflows/.github/workflows/security.yml@main
permissions:
contents: read
security-events: write