gh-action-readme/.github/workflows/security.yml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: "Security Scanning"

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    # Run security scans every Sunday at 2:00 AM UTC
    - cron: "0 2 * * 0"
  merge_group:

jobs:
  # Comprehensive security coverage:
  # - govulncheck: Go-specific vulnerability scanning
  # - trivy: Multi-language dependency & filesystem scanning
  # - gitleaks: Secrets detection in code history
  # - dependency-review: PR-level dependency analysis
  govulncheck:
    name: Go Vulnerability Check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          check-latest: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck ./...

  trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
        with:
          scan-type: "fs"
          scan-ref: "."
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH,MEDIUM"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
        if: always()
        with:
          sarif_file: "trivy-results.sarif"

      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
        with:
          scan-type: "fs"
          format: "github"
          output: "dependency-results.sbom.json"
          image-ref: "."
          github-pat: ${{ secrets.GITHUB_TOKEN }}

  secrets:
    name: Secrets Detection
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0 # Full history for gitleaks

      - name: Run gitleaks to detect secrets
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for gitleaks-action pro

  docker-security:
    name: Docker Image Security
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    if: github.event_name != 'pull_request' # Skip on PRs to avoid building images unnecessarily
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
        with:
          go-version-file: "go.mod"
          check-latest: true

      - name: Build the bin
        shell: bash
        run: make build

      - name: Build Docker image
        run: docker build -t gh-action-readme:test .

      - name: Run Trivy vulnerability scanner on Docker image
        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
        with:
          image-ref: "gh-action-readme:test"
          format: "sarif"
          output: "trivy-docker-results.sarif"

      - name: Upload Docker Trivy scan results
        uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
        if: always()
        with:
          sarif_file: "trivy-docker-results.sarif"

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - name: Dependency Review
        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
        with:
          fail-on-severity: high
          comment-summary-in-pr: always