Template — Security

Statut	Actif — v1.0 — 2026-06-27
Usage	Copier dans .github/workflows/security.yml
Voir aussi	Playbook Security

Usage

Copier dans .github/workflows/security.yml du projet.

Ce workflow tourne sur chaque PR. Il est informatif par défaut — ajouter aux required checks progressivement selon la maturité du projet.

Les jobs deps-npm et deps-composer ne tournent que si les fichiers de lock correspondants existent dans le projet.

Template

name: Security

# Standard DMV — minimal security checks on every PR.
# Detects secrets, vulnerable dependencies.
# Informational by default — add to required checks once team is familiar.

on:
  pull_request:

permissions:
  contents: read

jobs:
  secrets:
    name: Secret Detection
    runs-on: ubuntu-latest
    timeout-minutes: 5

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  deps-npm:
    name: npm Audit
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: hashFiles('package-lock.json') != ''

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Audit dependencies
        # --audit-level=high : only fail on high/critical vulnerabilities
        run: npm audit --audit-level=high

  deps-composer:
    name: Composer Audit
    runs-on: ubuntu-latest
    timeout-minutes: 5
    if: hashFiles('composer.lock') != ''

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          coverage: none

      - name: Audit dependencies
        run: composer audit