dadaloop82
da4bd635db
- README: remove Recent Updates section, clean roadmap (pending only), replace Screenshots with demo link, add 6 new badges (stars, last commit, contributors, discussions, CI), invite GIF contributions - CHANGELOG: translate all Italian entries to English, add v1.7.13 (DB fresh-install crash fix) - database.php: add missing 'undone' column to transactions schema; wrap ALTER TABLE calls in try/catch to prevent race-condition errors on concurrent first requests - Wiki: Android-Kiosk v1.5.0 → v1.6.0, Step 5 rewritten (BLE scan, no external APK), removed gateway troubleshooting section - Wiki: Scale-Gateway promoted to deprecated with redirect banner - Wiki: Home What's New updated to v1.7.12 / v1.7.13 - Wiki: Features.md, kiosk README Italian UI strings translated - .github: add bug_report.yml, feature_request.yml issue templates, config.yml (blank issues off, links to FAQ/Discussions/Security), PULL_REQUEST_TEMPLATE.md with checklist - .github: FUNDING.yml (Ko-fi), dependabot.yml (monthly action updates) - .github/workflows/security.yml: Trivy docker + fs scan, SARIF upload - .github/workflows/build-scale-gateway.yml: disabled (deprecated) - SECURITY.md: responsible disclosure policy, supported versions, scope - CODE_OF_CONDUCT.md: Contributor Covenant 2.1 - Settings UI: About section with version display, Report Bug button, Changelog and GitHub links; reportBugManual() + _loadAboutSection() - Translations: added 'about' key group (9 keys × 3 languages)
69 lines
1.7 KiB
YAML
69 lines
1.7 KiB
YAML
name: Security Scan (Trivy)
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
paths:
|
|
- 'Dockerfile'
|
|
- 'docker-compose.yml'
|
|
- 'api/**'
|
|
schedule:
|
|
# Run weekly on Monday at 07:00 UTC
|
|
- cron: '0 7 * * 1'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
trivy-docker:
|
|
name: Trivy — Docker image scan
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build Docker image
|
|
run: docker build -t evershelf:scan .
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: 'evershelf:scan'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
severity: 'CRITICAL,HIGH'
|
|
exit-code: '0' # don't fail the build, just report
|
|
|
|
- name: Upload Trivy SARIF to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'trivy-results.sarif'
|
|
category: 'trivy-docker'
|
|
|
|
trivy-fs:
|
|
name: Trivy — Filesystem scan
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Trivy filesystem scanner
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'fs'
|
|
scan-ref: '.'
|
|
format: 'sarif'
|
|
output: 'trivy-fs-results.sarif'
|
|
severity: 'CRITICAL,HIGH'
|
|
exit-code: '0'
|
|
|
|
- name: Upload Trivy FS SARIF
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'trivy-fs-results.sarif'
|
|
category: 'trivy-fs'
|