gh-action-readme/.github/workflows/security.yml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: 'Security Scanning'

on:
  push:
    branches: ['main']
  pull_request:
    branches: ['main']
  schedule:
    # Run security scans every Sunday at 2:00 AM UTC
    - cron: '0 2 * * 0'
  merge_group:

permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  govulncheck:
    name: Go Vulnerability Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.1.0
        with:
          go-version-file: 'go.mod'
          check-latest: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck ./...

  snyk:
    name: Snyk Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.1.0
        with:
          go-version-file: 'go.mod'
          check-latest: true

      - name: Run Snyk to check for Go vulnerabilities
        uses: snyk/actions/golang@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=medium --file=go.mod

      - name: Upload Snyk results to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
        if: always()
        with:
          sarif_file: snyk.sarif

  trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@99d1af36863c1ad4b3d47e56ab4aae73ffbf5d35 # v0.29.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@99d1af36863c1ad4b3d47e56ab4aae73ffbf5d35 # v0.29.0
        with:
          scan-type: 'fs'
          format: 'github'
          output: 'dependency-results.sbom.json'
          image-ref: '.'
          github-pat: ${{ secrets.GITHUB_TOKEN }}

  secrets:
    name: Secrets Detection
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0 # Full history for gitleaks

      - name: Run gitleaks to detect secrets
        uses: gitleaks/gitleaks-action@e3b19b53b4ccbc33a4b2ba67c9b5ce1adc8aa57a # v2.4.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for gitleaks-action pro

  docker-security:
    name: Docker Image Security
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' # Skip on PRs to avoid building images unnecessarily
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Build Docker image
        run: docker build -t gh-action-readme:test .

      - name: Run Trivy vulnerability scanner on Docker image
        uses: aquasecurity/trivy-action@99d1af36863c1ad4b3d47e56ab4aae73ffbf5d35 # v0.29.0
        with:
          image-ref: 'gh-action-readme:test'
          format: 'sarif'
          output: 'trivy-docker-results.sarif'

      - name: Upload Docker Trivy scan results
        uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
        if: always()
        with:
          sarif_file: 'trivy-docker-results.sarif'

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Dependency Review
        uses: actions/dependency-review-action@68d4ad8e15a3e94cae5f60db0b969b4ff9e31f0b # v4.5.0
        with:
          fail-on-severity: medium
          comment-summary-in-pr: always