From a370e8ae8d49b39639b4372827f804008bfa8f53 Mon Sep 17 00:00:00 2001 From: Marko Petzold Date: Fri, 30 Oct 2026 11:52:57 +0100 Subject: [PATCH] ci(security): block on findings --- .github/workflows/build-publish.yml | 2 +- .github/workflows/security.yml | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-publish.yml b/.github/workflows/build-publish.yml index dee9fe7..779fc6e 100644 --- a/.github/workflows/build-publish.yml +++ b/.github/workflows/build-publish.yml @@ -79,7 +79,7 @@ jobs: contents: read # The App key is a secret of the `release` environment; environment # secrets reach a reusable workflow only through `secrets: inherit`. - secrets: inherit # zizmor: ignore[secrets-inherit] + secrets: inherit # zizmor: ignore[secrets-inherit] # nosemgrep: yaml.github-actions.security.secrets-inherit.secrets-inherit with: version-file: package.json tag-prefix: "" diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b6057bb..833bbb4 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -2,9 +2,10 @@ # dependencies (osv-scanner on package-lock.json), semgrep, configuration and # licences. # -# Report-only for now (fail-on empty): the report job lists every finding; -# blocking follows once they are fixed. Accepted findings go into -# .trivyignore.yaml / security/vex.openvex.json / .gitleaks.toml with a reason. +# Blocking: a secret, a critical or high vulnerability with a fix, a high +# misconfiguration, a forbidden licence or a semgrep error fails the check. +# Accepted findings go into .trivyignore.yaml / security/vex.openvex.json / +# .gitleaks.toml with a reason and an expiry date. name: security on: @@ -30,4 +31,4 @@ jobs: security-events: write with: languages: node - fail-on: "" + fail-on: secrets,vuln-critical,vuln-high,misconfig-high,license-forbidden,semgrep-error