mirror of
https://github.com/ivuorinen/gh-action-readme.git
synced 2026-01-26 11:14:04 +00:00
129 lines
3.7 KiB
YAML
129 lines
3.7 KiB
YAML
---
|
|
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
|
|
name: 'Security Scanning'
|
|
|
|
on:
|
|
push:
|
|
branches: ['main']
|
|
pull_request:
|
|
branches: ['main']
|
|
schedule:
|
|
# Run security scans every Sunday at 2:00 AM UTC
|
|
- cron: '0 2 * * 0'
|
|
merge_group:
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
actions: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
# Comprehensive security coverage:
|
|
# - govulncheck: Go-specific vulnerability scanning
|
|
# - trivy: Multi-language dependency & filesystem scanning
|
|
# - gitleaks: Secrets detection in code history
|
|
# - dependency-review: PR-level dependency analysis
|
|
govulncheck:
|
|
name: Go Vulnerability Check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4 # v4.2.2
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5 # v5.5.0
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
check-latest: true
|
|
|
|
- name: Install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
|
|
- name: Run govulncheck
|
|
run: govulncheck ./...
|
|
|
|
trivy:
|
|
name: Trivy Security Scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4 # v4.2.2
|
|
|
|
- name: Run Trivy vulnerability scanner in repo mode
|
|
uses: aquasecurity/trivy-action@master # 0.32.0
|
|
with:
|
|
scan-type: 'fs'
|
|
scan-ref: '.'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
severity: 'CRITICAL,HIGH,MEDIUM'
|
|
|
|
- name: Upload Trivy scan results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v3 # v3.29.5
|
|
if: always()
|
|
with:
|
|
sarif_file: 'trivy-results.sarif'
|
|
|
|
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
|
|
uses: aquasecurity/trivy-action@master # 0.32.0
|
|
with:
|
|
scan-type: 'fs'
|
|
format: 'github'
|
|
output: 'dependency-results.sbom.json'
|
|
image-ref: '.'
|
|
github-pat: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
secrets:
|
|
name: Secrets Detection
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4 # v4.2.2
|
|
with:
|
|
fetch-depth: 0 # Full history for gitleaks
|
|
|
|
- name: Run gitleaks to detect secrets
|
|
uses: gitleaks/gitleaks-action@v2 # v2.4.0
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for gitleaks-action pro
|
|
|
|
docker-security:
|
|
name: Docker Image Security
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'pull_request' # Skip on PRs to avoid building images unnecessarily
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4 # v4.2.2
|
|
|
|
- name: Build Docker image
|
|
run: docker build -t gh-action-readme:test .
|
|
|
|
- name: Run Trivy vulnerability scanner on Docker image
|
|
uses: aquasecurity/trivy-action@master # 0.32.0
|
|
with:
|
|
image-ref: 'gh-action-readme:test'
|
|
format: 'sarif'
|
|
output: 'trivy-docker-results.sarif'
|
|
|
|
- name: Upload Docker Trivy scan results
|
|
uses: github/codeql-action/upload-sarif@v3 # v3.29.5
|
|
if: always()
|
|
with:
|
|
sarif_file: 'trivy-docker-results.sarif'
|
|
|
|
dependency-review:
|
|
name: Dependency Review
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request'
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4 # v4.2.2
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v4 # v4.7.1
|
|
with:
|
|
fail-on-severity: high
|
|
comment-summary-in-pr: always
|