refactor(core): core hygiene - remove duplicate validators, inline im… #973
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Audit | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| - cron: '0 6 * * *' | |
| jobs: | |
| python-audit: | |
| name: Python Dependencies Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| enable-cache: true | |
| - name: Set up Python | |
| run: uv python install 3.13 | |
| - name: Install dependencies | |
| run: | | |
| uv lock --check | |
| uv venv | |
| uv pip install -r requirements-dev.txt | |
| uv pip install -e packages/core | |
| uv pip install -e packages/libraries | |
| - name: Run pip-audit | |
| run: uv pip install pip-audit && uv run --no-project pip-audit --format=json --output=pip-audit.json --ignore-vuln PYSEC-2026-89 || true | |
| - name: Check for vulnerabilities | |
| if: always() | |
| run: | | |
| if [ -f pip-audit.json ]; then | |
| VULN_COUNT=$(jq '[.dependencies[] | select(.vulns? and (.vulns | length > 0))] | length' pip-audit.json) | |
| if [ "$VULN_COUNT" -gt 0 ]; then | |
| echo "Found $VULN_COUNT packages with vulnerabilities" | |
| exit 1 | |
| fi | |
| fi | |
| echo "No vulnerabilities found" | |
| shell: bash | |
| - name: Upload pip-audit results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: pip-audit-results | |
| path: pip-audit.json | |
| retention-days: 30 | |
| npm-audit: | |
| name: Node.js Dependencies Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 11 | |
| - name: Install dependencies | |
| working-directory: packages/studio | |
| run: pnpm install --frozen-lockfile | |
| - name: Run pnpm audit | |
| working-directory: packages/studio | |
| run: pnpm audit --json > npm-audit.json 2>&1 || true | |
| - name: Check for critical/high vulnerabilities | |
| if: always() | |
| run: | | |
| if [ -f packages/studio/npm-audit.json ] && head -c 1 packages/studio/npm-audit.json | grep -q '{'; then | |
| CRITICAL=$(jq '(.metadata.vulnerabilities.critical // 0) + (.metadata.vulnerabilities.high // 0)' packages/studio/npm-audit.json) | |
| if [ "$CRITICAL" -gt 0 ]; then | |
| echo "Found $CRITICAL critical/high vulnerabilities!" | |
| jq '.advisories | to_entries | map(select(.value.severity == "critical" or .value.severity == "high")) | .[:5]' packages/studio/npm-audit.json | |
| exit 1 | |
| fi | |
| fi | |
| echo "No critical/high vulnerabilities found or audit output is not valid JSON" | |
| shell: bash | |
| - name: Upload npm audit results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: npm-audit-results | |
| path: packages/studio/npm-audit.json | |
| retention-days: 30 | |
| security-summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [python-audit, npm-audit] | |
| if: always() | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: ./audit-results | |
| - name: Display audit results | |
| run: | | |
| echo "## Security Audit Summary" | |
| echo "" | |
| echo "### Python Dependencies" | |
| if [ -f ./audit-results/pip-audit-results/pip-audit.json ]; then | |
| echo "```json" | |
| cat ./audit-results/pip-audit-results/pip-audit.json | |
| echo "```" | |
| else | |
| echo "No vulnerabilities found or audit skipped" | |
| fi | |
| echo "" | |
| echo "### Node.js Dependencies" | |
| if [ -f ./audit-results/npm-audit-results/npm-audit.json ]; then | |
| echo "```json" | |
| cat ./audit-results/npm-audit-results/npm-audit.json | |
| echo "```" | |
| else | |
| echo "No vulnerabilities found or audit skipped" | |
| fi |