Merge pull request #141 from ropable/master

Switch ujson for orjson, bump other dependencies, other tweaks

.github/workflows/docker-publish.yml

@@ -3,11 +3,11 @@ name: "Build Docker image and run Trivy vulnerability scan"
 on:
   push:
     # Publish `master` as `latest` image.
-    branches: [ master ]
+    branches: [master]
     # Publish `2.*` tags as releases.
-    tags: [ '2.*' ]
+    tags: ["2.*"]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 env:
   REGISTRY: ghcr.io
@@ -77,15 +77,18 @@ jobs:
       # Run vulnerability scan on built image
       #----------------------------------------------
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/[email protected]
+        env:
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
         with:
-          scan-type: 'image'
+          scan-type: "image"
+          scanners: "vuln"
           image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          vuln-type: 'os,library'
-          severity: 'HIGH,CRITICAL'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
+          vuln-type: "os,library"
+          severity: "HIGH,CRITICAL"
+          format: "sarif"
+          output: "trivy-results.sarif"
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: 'trivy-results.sarif'
+          sarif_file: "trivy-results.sarif"

.github/workflows/secret-scan.yml

@@ -0,0 +1,25 @@
+name: "Scan project for secrets & sensitive information"
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  secret-scan:
+    name: Scan project for secrets
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Secret scanning
+      uses: trufflesecurity/trufflehog@main
+      with:
+        base: ""
+        head: ${{ github.ref_name }}
+        extra_args: --only-verified

.pre-commit-config.yaml

@@ -8,4 +8,4 @@ repos:
       # For running trufflehog in docker, use the following entry instead:
       # entry: bash -c 'docker run --rm -v "$(pwd):/workdir" -i --rm trufflesecurity/trufflehog:latest git file:///workdir --since-commit HEAD --only-verified --fail'
       language: system
-      stages: ["commit", "push"]
+      stages: ["pre-commit", "pre-push"]