craft-native/craft
fix(security): validate vulnerability scans and pin scanner downloads
#300
Merged
glennmichael123
wants to merge
codex/failure-safe-vulnerability-scan
into
main
5 files
+192
-56
.github/workflows/ci.ymlmodified+3-0Changes to .github/workflows/ci.yml | @@ -271,6 +271,9 @@ jobs: |
| 271 | 271 | working-directory: packages/zig |
| 272 | 272 | run: zig fmt --check src/ build.zig |
| 273 | 273 | |
| 274 | + - name: Test failure-safe vulnerability scanning |
| 275 | + run: bun test scripts/scan-sbom.test.ts |
| 276 | + |
| 274 | 277 | - name: Audit Zig C imports |
| 275 | 278 | run: bun run verify:cimports |
| 276 | 279 | |