Skip to content

feat(lighthouse): add weekly lighthouse audit scan #286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tehw0lf merged 3 commits into from
Jun 24, 2026
Merged

feat(lighthouse): add weekly lighthouse audit scan #286

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ec5726f
feat(lighthouse): add weekly lighthouse audit scan
tehw0lf Jun 24, 2026
baffd6b
chore: bump version to 0.22.7
tehw0lf Jun 24, 2026
3f92634
chore: bump version to 0.22.8
tehw0lf Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/lighthouse-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: weekly lighthouse scan

on:
schedule:
- cron: "0 4 * * 1"
workflow_dispatch:

jobs:
lighthouse:
name: external workflow
uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== file listing ==\n'
git ls-files .github/workflows/lighthouse-scan.yml

printf '\n== workflow file with line numbers ==\n'
cat -n .github/workflows/lighthouse-scan.yml

printf '\n== any local references to the external workflow repo/ref ==\n'
rg -n "tehw0lf/workflows|lighthouse-scan.yml@|workflow_call" .github/workflows . -g '!**/node_modules/**' || true

Repository: tehw0lf/tehwol.fi

Length of output: 1312

Pin the reusable workflow ref.

uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main tracks a mutable branch, so this external dependency can change without review and weakens reproducibility.

🔧 Suggested fix 
-    uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main
+    uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@<commit-sha>
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@main
uses: tehw0lf/workflows/.github/workflows/lighthouse-scan.yml@<commit-sha>
🧰 Tools
🪛 zizmor (1.26.1)

[error] 11-11: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/lighthouse-scan.yml at line 11, The reusable workflow
reference in the lighthouse scan job is pinned to a mutable branch, so update
the uses reference to a fixed, reviewable ref such as a tag or commit SHA.
Locate the workflow call in the lighthouse scan job and replace the current
`@main` target with an immutable version so the dependency cannot change
unexpectedly.

Source: Linters/SAST tools

@tehw0lf tehw0lf Jun 24, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This works as designed

permissions:
contents: read
issues: write
with:
target_url: "https://tehwolf.de"
Loading