<commit_before>name: CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

permissions:
  contents: read

concurrency: 
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:

    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    needs: dependency-scan
    strategy:
      max-parallel: 4
      matrix:
        node-version: [12.x, 14.x, 16.x]

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          registry.npmjs.org:443

    - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v2
      with:
        node-version: ${{ matrix.node-version }}

    - name: Set shell options
      run: |
        set -o xtrace

    - name: Install dependencies
      run: |
        node -v
        npm ci --no-optional

    - name: Run linter
      run: |
        npm run lint

    - name: Upload eslint report
      uses: github/codeql-action/upload-sarif@1ed1437484560351c5be56cf73a48a279d116b78 # v1
      with:
        sarif_file: results.sarif

  semgrep:
    name: semgrep
    runs-on: ubuntu-latest
    needs: dependency-scan
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            metrics.semgrep.dev:443
            semgrep.dev:443
            api.snapcraft.io:443

      - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
      - uses: returntocorp/semgrep-action@b93bc50eb1bd1a016cf749808608ee465db13f9d # v1
        with:
          auditOn: push
          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
          publishDeployment: 2081

  analyze:
    permissions:
      actions: read # for github/codeql-action/init to get workflow details
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/analyze to upload SARIF results
    name: Analyze
    runs-on: ubuntu-latest
    needs: dependency-scan
    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          registry.npmjs.org:443

    - name: Checkout repository
      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@1ed1437484560351c5be56cf73a48a279d116b78 # v1
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Install dependencies
      run: |
        node -v
        npm ci --no-optional

    - name: Run a build
      run: |
        npm run build

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@1ed1437484560351c5be56cf73a48a279d116b78 # v1

  dependency-scan:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          objects.githubusercontent.com:443
          ghcr.io:443
          pkg-containers.githubusercontent.com:443

    - name: Checkout the code
      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
      with:
        fetch-depth: 0

    - name: Run vulnerability scanner in repo mode
      if: github.actor != 'dependabot[bot]'
      uses: aquasecurity/trivy-action@40c4ca9e7421287d0c5576712fdff370978f9c3c # 0.2.1
      with:
        scan-type: 'fs'
        ignore-unfixed: false
        exit-code: 1
        format: 'table'
        vuln-type: 'library'
        severity: 'CRITICAL,HIGH'

    - name: Run vulnerability scanner in repo mode
      if: github.actor == 'dependabot[bot]'
      uses: aquasecurity/trivy-action@40c4ca9e7421287d0c5576712fdff370978f9c3c # 0.2.1
      with:
        scan-type: 'fs'
        ignore-unfixed: false
        exit-code: 1
        format: 'table'
        vuln-type: 'library'
        severity: 'MEDIUM,HIGH,CRITICAL'<commit_msg>chore(deps): bump aquasecurity/trivy-action from 0.2.3 to 0.2.5 (#357)<commit_after>name: CI

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

permissions:
  contents: read

concurrency: 
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:

    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest
    needs: dependency-scan
    strategy:
      max-parallel: 4
      matrix:
        node-version: [12.x, 14.x, 16.x]

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          registry.npmjs.org:443

    - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@56337c425554a6be30cdef71bf441f15be286854 # v2
      with:
        node-version: ${{ matrix.node-version }}

    - name: Set shell options
      run: |
        set -o xtrace

    - name: Install dependencies
      run: |
        node -v
        npm ci --no-optional

    - name: Run linter
      run: |
        npm run lint

    - name: Upload eslint report
      uses: github/codeql-action/upload-sarif@1ed1437484560351c5be56cf73a48a279d116b78 # v1
      with:
        sarif_file: results.sarif

  semgrep:
    name: semgrep
    runs-on: ubuntu-latest
    needs: dependency-scan
    if: (github.actor != 'dependabot[bot]')
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
        with:
          egress-policy: block
          allowed-endpoints: >
            github.com:443
            metrics.semgrep.dev:443
            semgrep.dev:443
            api.snapcraft.io:443

      - uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
      - uses: returntocorp/semgrep-action@b93bc50eb1bd1a016cf749808608ee465db13f9d # v1
        with:
          auditOn: push
          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
          publishDeployment: 2081

  analyze:
    permissions:
      actions: read # for github/codeql-action/init to get workflow details
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/analyze to upload SARIF results
    name: Analyze
    runs-on: ubuntu-latest
    needs: dependency-scan
    strategy:
      fail-fast: false
      matrix:
        language: [ 'javascript' ]
        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
        # Learn more:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          registry.npmjs.org:443

    - name: Checkout repository
      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@1ed1437484560351c5be56cf73a48a279d116b78 # v1
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Install dependencies
      run: |
        node -v
        npm ci --no-optional

    - name: Run a build
      run: |
        npm run build

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@1ed1437484560351c5be56cf73a48a279d116b78 # v1

  dependency-scan:
    if: github.event.pull_request.draft == false
    runs-on: ubuntu-latest

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          github.com:443
          objects.githubusercontent.com:443
          ghcr.io:443
          pkg-containers.githubusercontent.com:443

    - name: Checkout the code
      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
      with:
        fetch-depth: 0

    - name: Run vulnerability scanner in repo mode
      if: github.actor != 'dependabot[bot]'
      uses: aquasecurity/trivy-action@2b30463ddb3d11724a04e760e020c7d9af24d8b3 # 0.2.1
      with:
        scan-type: 'fs'
        ignore-unfixed: false
        exit-code: 1
        format: 'table'
        vuln-type: 'library'
        severity: 'CRITICAL,HIGH'

    - name: Run vulnerability scanner in repo mode
      if: github.actor == 'dependabot[bot]'
      uses: aquasecurity/trivy-action@2b30463ddb3d11724a04e760e020c7d9af24d8b3 # 0.2.1
      with:
        scan-type: 'fs'
        ignore-unfixed: false
        exit-code: 1
        format: 'table'
        vuln-type: 'library'
        severity: 'MEDIUM,HIGH,CRITICAL'
{'fraction_non_alphanumeric': 0.09129840546697039, 'fraction_numerical': 0.0862870159453303, 'mean_word_length': 2.366871165644172, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 11, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '887360', 'n_tokens_mistral': 4330, 'n_tokens_neox': 3750, 'n_words': 768}