Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

riatzukiza / opencode Public

forked from anomalyco/opencode

Notifications You must be signed in to change notification settings
Fork 0
Star 1

Code
Issues 15
Pull requests 1
Actions
Projects
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Security
Insights

Add security scanning workflows#2

Closed

riatzukiza wants to merge 72 commits intodevops/3415-windows-virus-false-positiveriatzukiza/opencode:devops/3415-windows-virus-false-positivefrom

codex/add-github-actions-for-security-auditsriatzukiza/opencode:codex/add-github-actions-for-security-auditsCopy head branch name to clipboard

Conversation Commits72 (72)Checks Files changed

Closed

Add security scanning workflows#2
riatzukiza wants to merge 72 commits intodevops/3415-windows-virus-false-positivefrom
codex/add-github-actions-for-security-audits

Commits

Commits on Oct 31, 2025

ci: ignore

thdxr
authored and
riatzukiza
committed
ci: ignore

thdxr
authored and
riatzukiza
committed
fix: unawaited promise causes opencode to use unenabled formatter (#625)

rekram1-node
authored and
riatzukiza
committed
fix: typescript error (#618)

timoclsn
authored and
riatzukiza
committed
ignore: ci

thdxr
authored and
riatzukiza
committed
ci: ignore

thdxr
authored and
riatzukiza
committed
Add opencode workflow

Frank
authored and
riatzukiza
committed
Add opencode workflow

Frank
authored and
riatzukiza
committed
Add opencode workflow

Frank
authored and
riatzukiza
committed
Add opencode workflow

Frank
authored and
riatzukiza
committed
Add opencode workflow

Frank
authored and
riatzukiza
committed
add threat scanning workflows
riatzukiza
committed
adjusted event triggers
riatzukiza
committed
reverting accidental edit
riatzukiza
committed
ci: guard AV workflows on PRs + robust tag resolution
riatzukiza
committed
ci: enable PR/push AV scans (no releases required)
riatzukiza
committed
ci: add heuristic build steps to PR ClamAV job (Node/Rust/Go)
riatzukiza
committed
ci: harden heuristic PR build (corepack, non-fatal builds, tarball)
riatzukiza
committed
ci: add Bun (bun.lockb) support to PR build (Ubuntu)
riatzukiza
committed
ci: remove third‑party setup actions in PR scan; install Bun/Rust via shell
riatzukiza
committed
ci: add minimal smoke workflow (ubuntu/windows/macos) to diagnose startup failures
riatzukiza
committed
removeed push action
riatzukiza
committed
yaml error
riatzukiza
committed
removed useless smoke test
riatzukiza
committed
ci: fix scanners (owasp dep-check action pin, clamav DB init, windows zip contention)
riatzukiza
committed
ci(owasp,defender): fix dep-check inputs (no 'out'; use format=ALL + args --out); avoid zip handle contention by using unique filename and glob for scan/upload
riatzukiza
committed
ci(clamav): detect bun/node/rust/go across repo; only run node when no bun; stage outputs; extract before clamscan for real file counts
riatzukiza
committed
ci(defender): avoid Compress-Archive lock by zipping to %RUNNER_TEMP% with bsdtar + retries; then Move-Item into dist-pr
riatzukiza
committed
ci(defender-pr): scan directory instead of the zip to avoid archive-skip policy; attach detections JSON in artifact
riatzukiza
committed
ci(owasp): prep dependencies (bun or node) so ODC sees installed modules; upload from 'reports' (action default)
riatzukiza
committed
ci(defender-pr): fix scan_root propagation (use step outputs) and add null-guard
riatzukiza
committed
ci(clamav-pr): build with Bun per README/workflows (no language detection), package build output and scan with ClamAV
riatzukiza
committed
ci(clamav release): build with Bun (single build per README), package outputs, extract + scan with ClamAV, upload logs + payload
riatzukiza
committed
ci(clamav): use local setup-bun action per repo docs; split PATH application to next step
riatzukiza
committed
build: add composite action to build with Bun and package single zip (bundle/opencode.zip)
riatzukiza
committed
ci(clamav-pr): use shared build-package composite; produce single bundle/opencode.zip; scan extracted bundle
riatzukiza
committed
ci(clamav-release): consume shared build-package; scan extracted bundle; upload bundle
riatzukiza
committed
ci(defender): depend on shared build-package; download single opencode.zip; scan extracted directory; upload detections
riatzukiza
committed
ci(clamav): unify into single workflow .github/workflows/clam-av.yml; PR/release/dispatch share one build via composite; deprecate old PR/Release files
riatzukiza
committed
build(composite): use bunx turbo run build (root build script not present); package dist/build if present else repo minus heavy dirs
riatzukiza
committed
ci(owasp): bun monorepo support — setup via local action, bun install, create per-package node_modules symlinks so ODC sees deps; enable experimental analyzers; upload reports
riatzukiza
committed
ci(setup-bun): pin default Bun to 1.3.0 to satisfy strict build script; allow override via input
riatzukiza
committed
ci(bun): restore setup-bun default to 'latest' to avoid breaking existing workflows; pin 1.3.0 only in build-package composite used by scanners
riatzukiza
committed
Delete .github/workflows/clam-av-scan.yml
riatzukiza
committed
Delete .github/workflows/clam-av-pr.yml
riatzukiza
committed
chore(format): use `bunx prettier` instead of `bun run prettier` (no prettier script defined)
riatzukiza
committed
ci(setup-bun): restore legacy behavior — run `bun install` inside setup-bun for back-compat with existing workflows
riatzukiza
committed
ci: pin Bun to 1.3.0 globally in setup-bun (with install step) and revert non-security change to script/format.ts
riatzukiza
committed
ci(defender): force Bun 1.3.0 in build-package; ensure build job emits artifact and defender job scans extracted dir
riatzukiza
committed
nope
riatzukiza
committed
so we may have needed that one
riatzukiza
committed
I can read
riatzukiza
committed
oops
riatzukiza
committed
????
riatzukiza
committed
specify bun version file for setup-bun action
riatzukiza
committed
I can definitely read
riatzukiza
committed
lock in bun version
riatzukiza
committed
be specific
riatzukiza
committed
add bun version to hash function
riatzukiza
committed
stuff
riatzukiza
committed
ci(setup-bun): make cache version-strict & self-invalidating; clear ~/.bun if cached version != requested; keep bun install step
riatzukiza
committed
ci(setup-bun): read version from .bun-version and disable tool-cache; verify exact version. build-package now uses this action.
riatzukiza
committed
Kill robot fantasy
riatzukiza
committed
well then
riatzukiza
committed
EICAR string test
riatzukiza
committed
ooops
riatzukiza
committed
trying to trigger security check
riatzukiza
committed
it should only pass if it fails
riatzukiza
committed
robot's don't want you to be safe
riatzukiza
committed
Won't work in github ci
riatzukiza
committed
Add security scanning workflows
riatzukiza
committed
Adjust security scan workflows
riatzukiza
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.