- Remove CodeQL job: this repo has no JS/TS or Rust source code,
so CodeQL exits with error 32 ('no source code seen during build')
on every run. CodeQL belongs on nixpanel-website/nixpanel-licensing.
- cargo-audit: skip Rust toolchain install entirely when no Cargo.toml
present (saves ~3 min of wasted CI time); use step output condition
- ShellCheck: severity error->only fails on real errors, not style
warnings; pin to ludeeus/[email protected] (not @master)
- Rename workflow to 'Security Audit' (CodeQL is no longer included)
- CodeQL: scans JS/TS with security-extended + security-and-quality queries
- cargo-audit: scans Rust dependencies for known CVEs (--deny warnings)
- ShellCheck: lints install.sh and all shell scripts for bugs/vulnerabilities
- Runs on push to master, PRs, and weekly on Mondays at 08:00 UTC
NixReaper