Container security (#32)

* feat: container vulnerability scanning * fix: Skip safety for dependabot
2026-01-12 13:23:32 -08:00
parent 75726329c7
commit 9dde1cef21
8 changed files with 170 additions and 49 deletions
@@ -47,9 +47,12 @@ jobs:
          # Skip hooks that don't work well in CI:
          # - no-commit-to-branch: Always fails in CI (we're on main/master)
          # - trufflehog: Has wasm/go-re2 panic bug in GitHub Actions environment
+          # - safety: Skipped if SAFETY_API_KEY secret is not configured
          # Note: shellcheck, hadolint, trivy use mise-managed binaries which ARE
          # installed by mise-action above, so they should work in CI.
-          SKIP: no-commit-to-branch,trufflehog
+          SKIP: no-commit-to-branch,trufflehog${{ secrets.SAFETY_API_KEY == '' && ',safety' || '' }}
          # Safety CLI API key for dependency vulnerability scanning
+          # Get your key at: https://safetycli.com/ (free account)
+          # Add as repository secret: Settings → Secrets → Actions → SAFETY_API_KEY
          SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
        run: uv run pre-commit run --all-files --show-diff-on-failure