gh-action-readme/.github/workflows/security.yml

---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: 'Security Scanning'

on:
  push:
    branches: ['main']
  pull_request:
    branches: ['main']
  schedule:
    # Run security scans every Sunday at 2:00 AM UTC
    - cron: '0 2 * * 0'
  merge_group:

permissions:
  contents: read
  security-events: write
  actions: read
  pull-requests: write

jobs:
  # Comprehensive security coverage:
  # - govulncheck: Go-specific vulnerability scanning
  # - trivy: Multi-language dependency & filesystem scanning
  # - gitleaks: Secrets detection in code history
  # - dependency-review: PR-level dependency analysis
  govulncheck:
    name: Go Vulnerability Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4 # v4.2.2

      - name: Set up Go
        uses: actions/setup-go@v5 # v5.5.0
        with:
          go-version-file: 'go.mod'
          check-latest: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck ./...

  trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4 # v4.2.2

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@master # 0.32.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3 # v3.29.5
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@master # 0.32.0
        with:
          scan-type: 'fs'
          format: 'github'
          output: 'dependency-results.sbom.json'
          image-ref: '.'
          github-pat: ${{ secrets.GITHUB_TOKEN }}

  secrets:
    name: Secrets Detection
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4 # v4.2.2
        with:
          fetch-depth: 0 # Full history for gitleaks

      - name: Run gitleaks to detect secrets
        uses: gitleaks/gitleaks-action@v2 # v2.4.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for gitleaks-action pro

  docker-security:
    name: Docker Image Security
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' # Skip on PRs to avoid building images unnecessarily
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4 # v4.2.2

      - name: Build Docker image
        run: docker build -t gh-action-readme:test .

      - name: Run Trivy vulnerability scanner on Docker image
        uses: aquasecurity/trivy-action@master # 0.32.0
        with:
          image-ref: 'gh-action-readme:test'
          format: 'sarif'
          output: 'trivy-docker-results.sarif'

      - name: Upload Docker Trivy scan results
        uses: github/codeql-action/upload-sarif@v3 # v3.29.5
        if: always()
        with:
          sarif_file: 'trivy-docker-results.sarif'

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4 # v4.2.2

      - name: Dependency Review
        uses: actions/dependency-review-action@v4 # v4.7.1
        with:
          fail-on-severity: high
          comment-summary-in-pr: always