Repository navigation
One source for artist moods: music_tags; artist_tags removed #373
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OSV-Scanner — dependency vulnerability scanning against osv.dev (Google). | |
| # Scans requirements.txt (and any future manifests) on push/PR + a weekly | |
| # sweep; the PR job fails when a change INTRODUCES a known-vulnerable | |
| # dependency. Complements Dependabot: osv.dev aggregates GHSA + PyPA + more, | |
| # and the PR gate catches what Dependabot only reports after the fact. | |
| # | |
| # Third-party reusable workflow → pinned to a full commit SHA on purpose | |
| # (tj-actions lesson). Bump by moving the SHA, never to a floating tag. | |
| # | |
| # scan-args, and why each line is there: | |
| # -r walk the tree (requirements.txt at the root today). | |
| # --no-resolve requirements.txt pins the 17 direct dependencies only; | |
| # 2.6.0 otherwise resolves the rest through deps.dev and | |
| # reports floor versions no install ever gets (requests | |
| # 2.9.2, anyio 4.9.0, idna 3.9.0, orjson 3.9.15 while pip | |
| # installs 2.34 / 4.13 / 3.18 / 3.11). A lock file of the | |
| # tested install is lock/requirements.txt (src/deps_lock.py, | |
| # kept current by the launchers), scanned as well: that is | |
| # where a transitive advisory shows up, against the version | |
| # that actually runs. | |
| # --config osv-scanner.toml applies per directory by default; the | |
| # flag makes the root file cover lock/ too. | |
| # no --skip-git the CLI rejects the flag ("flag provided but not | |
| # defined", exit 127). The 2.5.1 reusable workflow had no | |
| # "scan completed" check, so its reporter read a missing | |
| # results file and printed "No issues found": every green | |
| # OSV run up to 2026-09-19 had scanned nothing. 2.6.0 checks. | |
| # Exceptions live in osv-scanner.toml (root), are explained in SECURITY.md | |
| # and kept in step by tests/test_osv_config.py. Both jobs ride ONE | |
| # reusable-workflow commit (tests/test_workflow_pins.py), because Dependabot | |
| # bumps each `uses:` path as a PR of its own. | |
| name: OSV-Scanner | |
| on: | |
| pull_request: | |
| branches: [ "main" ] | |
| merge_group: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: '35 21 * * 6' | |
| push: | |
| branches: [ "main" ] | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan-scheduled: | |
| if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0 | |
| with: | |
| scan-args: |- | |
| -r | |
| --no-resolve | |
| --config=osv-scanner.toml | |
| ./ | |
| scan-pr: | |
| if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0 | |
| with: | |
| scan-args: |- | |
| -r | |
| --no-resolve | |
| --config=osv-scanner.toml | |
| ./ |