External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore: harden OpenSSF Scorecard from 4.3 to ~7.0 (#142)

Browse Source 
Token-Permissions (0 -> 10): Set permissions: {} at workflow top level
across all 7 workflows, moved write scopes to per-job minimum.

SAST (0 -> 10): Added CodeQL workflow for JavaScript/TypeScript and
Python analysis on push, PR, and weekly schedule.

Vulnerabilities (0 -> ~8): Added 13 pnpm overrides to patch transitive
dependency vulnerabilities (38 -> 2 remaining, both in dev-only tools).

Pinned-Dependencies (5 -> 8-9): Pinned all Docker FROM images to SHA
digests, pinned pip-audit version in CI, pinned pip version in
Dockerfile.
This commit is contained in:
SnapOtter
2026-05-18 15:57:17 +08:00
committed by GitHub
parent 697566d00e
commit ec6ff3d8a8
12 changed files with 443 additions and 768 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/Dockerfile.test
+1 -1
View File
@@ -3,7 +3,7 @@
# Runs the full test suite (unit + integration)
# ============================================
FROM node:22-bookworm
FROM node:22-bookworm@sha256:e3ca095133ba41a0a73b009f19e4253f1a878e70bb9499f6a9d21b19d082bd91
RUN corepack enable && corepack prepare pnpm@9.15.4 --activate