mirror of
https://github.com/aaronsb/obsidian-mcp-plugin.git
synced 2026-07-22 06:45:14 +00:00
fc47349e18
Incorporates the open dependabot dev-dependency PRs as one coherent, tightly verified upgrade rather than five separate rebase/CI cycles, since they interact across the build/lint toolchain: - eslint 9.39.2 → 10.5.0 and @eslint/js 9.39.2 → 10.0.1 (#235 + #236 — these are coupled: @eslint/js@10 peer-requires eslint@10, so #236 could only ever resolve alongside #235; neither lands alone) - typescript 5.9.3 → 6.0.3 (#237) - typescript-eslint / @typescript-eslint/utils 8.60.1 → 8.62.0, esbuild 0.28.0 → 0.28.1, globals 17.6.0 → 17.7.0, obsidian 1.13.0 → 1.13.1 (#246, which also subsumes the standalone esbuild bump in #233) - actions/checkout v6 → v7 across all workflows (#240) TypeScript 6 turns two tsconfig deprecations into errors. Fixed by modernizing the config, not suppressing — Obsidian's community-plugin source review forbids `ignoreDeprecations`-style escape hatches and rewards tight configs: - dropped `baseUrl: "."` (TS5101) — unused; every local import is relative - `moduleResolution: "node"` → `"bundler"` (TS5107) — the correct modern value for an esbuild-bundled project with extensionless imports (node16/nodenext would force `.js` extensions and break every relative import) Also ran `npm audit fix` (security fixes are hold-exempt) clearing two dev/test transitive advisories (@babel/core file-read, js-yaml merge-key DoS) that were pre-existing on main via the jest/istanbul chain — `npm audit` now reports 0. Verified tight: `npm run build && npm run lint && npm test` all green, 352/352 tests pass, no rule suppressions added.
38 lines
No EOL
801 B
YAML
38 lines
No EOL
801 B
YAML
name: Security Checks
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
schedule:
|
|
- cron: '0 0 * * 0' # Weekly on Sunday
|
|
|
|
permissions:
|
|
security-events: write
|
|
contents: read
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Run npm audit
|
|
run: npm audit --production
|
|
continue-on-error: true # Don't fail the build, just report
|
|
|
|
- name: Run security checks
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'fs'
|
|
scan-ref: '.'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
|
|
- name: Upload Trivy scan results
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
if: always()
|
|
with:
|
|
sarif_file: 'trivy-results.sarif' |