add package file for tests

.gitea/workflows/security.yml

@@ -67,23 +67,20 @@ jobs:
           sudo chmod +x /usr/local/bin/gitleaks
           gitleaks version
 
+      # We remove the Trivy cache to avoid false positives
       - name: Run Gitleaks secret scan
         run: |
+          rm -rf .cache/trivy
           gitleaks detect --source . --report-path gitleaks-results.json --report-format json --no-git
-          gitleaks detect --source . --report-path gitleaks-results.txt --report-format txt
 
       - name: Display Gitleaks scan results
         if: always()
         run: |
-          if [ -f gitleaks-results.txt ]; then
+          if [ -f gitleaks-results.json ]; then
             echo "=== Gitleaks Secret Scan Results ==="
-            cat gitleaks-results.txt
+            cat gitleaks-results.json
           else
             echo "No secrets detected by Gitleaks"
-          fi
-          if [ -f gitleaks-results.json ] && [ -s gitleaks-results.json ]; then
-            echo "=== Gitleaks JSON Results ==="
-            cat gitleaks-results.json
             exit 1
           fi
 
@@ -101,7 +98,8 @@ jobs:
           semgrep --config p/security-audit \
             --config p/owasp-top-ten \
             --config p/ci \
-            --config p/security \
+            --config p/r2c-security-audit \
+            --config p/cwe-top-25 \
             --output semgrep-results.txt \
             .
 
@@ -124,12 +122,12 @@ jobs:
       - name: Install OSV Scanner
         run: |
           export PATH="$HOME/go/bin:$PATH"
-          go install github.com/google/osv-scanner/cmd/osv-scanner@latest
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
 
       - name: Run OSV Scanner
         run: |
           export PATH="$HOME/go/bin:$PATH"
-          osv-scanner -r scan --format table --output osv-results.txt .
+          osv-scanner scan source --format table --output osv-results.txt -r .
 
       - name: Display OSV Scanner scan results
         if: always()

.gitignore

@@ -0,0 +1 @@
+node_modules/

package.json

@@ -0,0 +1,16 @@
+{
+  "name": "actions-sandbox",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "packageManager": "pnpm@10.24.0",
+  "dependencies": {
+    "@nhcarrigan/logger": "1.1.1"
+  }
+}

pnpm-lock.yaml

@@ -0,0 +1,22 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@nhcarrigan/logger':
+        specifier: 1.1.1
+        version: 1.1.1
+
+packages:
+
+  '@nhcarrigan/logger@1.1.1':
+    resolution: {integrity: sha512-P6OEQFHDtf6psybYGljuCxkSW6DLQCsx1aZZ3w4YKBXHBFjDbhuvpM9K1kPhVN48hakitx2WPLEoIFr6YZELYw==}
+
+snapshots:
+
+  '@nhcarrigan/logger@1.1.1': {}