0.0.0-beta.1

.github/package.json

@@ -0,0 +1,11 @@
+{
+	"name": "@1auth/github-workflows",
+	"version": "0.0.0-beta.1",
+	"private": true,
+	"engines": {
+		"node": ">=24.0"
+	},
+	"devDependencies": {
+		"lockfile-lint": "5.0.0"
+	}
+}

.github/workflows/test-sast.yml

@@ -13,44 +13,70 @@ permissions:
   contents: read
 
 jobs:
-  sandworm:
-    name: "sandworm: SCA & Licensing"
+  # https://github.com/aquasecurity/trivy-action
+  trivy-vuln:
+    name: "Trivy: SCA"
+    runs-on: ubuntu-latest
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      - name: Checkout repositorys
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Trivy
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
+        with:
+          scanners: vuln
+          scan-type: fs
+          scan-ref: package-lock.json
+          hide-progress: true
+          ignore-unfixed: true
+          exit-code: 1
+          format: github
+
+  trivy-license:
+    name: "Trivy: Licensing"
     runs-on: ubuntu-latest
     if: (github.actor != 'dependabot[bot]')
-
     steps:
       - name: Checkout repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
-          cache: 'npm'
           node-version: ${{ env.NODE_VERSION }}
-          registry-url: "https://registry.npmjs.org"
-      - name: Remove deprecated npm config
-        run: npm config delete always-auth
-      - name: Install sandworm
-        run: npm i -g @sandworm/audit@1.56.1
-      - name: sandworm
-        run: sandworm-audit --skip-tree
+          registry-url: https://registry.npmjs.org
+      - name: Install dependencies
+        run: |
+          npm ci --ignore-scripts
+      - name: Trivy
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
+        with:
+          scanners: license
+          scan-type: fs
+          scan-ref: .
+          hide-progress: true
+          exit-code: 0
+          format: table
 
   lockfile:
-    name: 'lockfile-lint: SAST package-lock.json'
+    name: "lockfile-lint: SAST package-lock.json"
     runs-on: ubuntu-latest
     if: (github.actor != 'dependabot[bot]')
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org
-      - name: Install lockfile-lint
-        run: npm i -g lockfile-lint@4.14.1
+      - name: Install dependencies
+        run: |
+          npm ci --ignore-scripts --workspace .github
       - name: lockfile-lint
-        run: lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https
+        run: |
+          ./node_modules/.bin/lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https
+
 
   # https://github.com/github/codeql-action
   codeql:

.gitignore

@@ -110,3 +110,4 @@ dist
 
 # IDE
 .nova
+.idea

biome.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.3.11/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.3.14/schema.json",
 	"vcs": {
 		"enabled": false,
 		"clientKind": "git",

license.json

@@ -0,0 +1,29 @@
+{
+	"license": "license.template",
+	"licenseFormats": {
+		"js|ts": {
+			"eachLine": {
+				"prepend": "// "
+			}
+		}
+	},
+	"ignoreFile": ".gitignore",
+	"ignore": [
+		".github/**/*",
+		".husky/**/*",
+		"CNAME",
+		"commitlint.config.cjs",
+		"docs/**/*",
+		"LICENSE",
+		"license.template",
+		"**/.gitignore",
+		"**/*.fuzz.js",
+		"**/*.perf.js",
+		"**/*.test.js",
+		"**/*.tst.ts",
+		"**/*.md",
+		"**/*.yml",
+		"test/**/*",
+		"website/**/*"
+	]
+}

license.template

@@ -0,0 +1,2 @@
+Copyright 2003 - 2026 will Farrell, and 1Auth contributors.
+SPDX-License-Identifier: MIT