mirror of
https://github.com/ivuorinen/gibidify.git
synced 2026-01-26 11:34:03 +00:00
98 lines
2.9 KiB
YAML
98 lines
2.9 KiB
YAML
---
|
|
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
branches: [main, develop]
|
|
schedule:
|
|
# Run security scan weekly on Sundays at 00:00 UTC
|
|
- cron: "0 0 * * 0"
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
security:
|
|
name: Security Analysis
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
security-events: write
|
|
contents: read
|
|
actions: read
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
|
|
|
|
- name: Setup Go
|
|
uses: ./.github/actions/setup
|
|
with:
|
|
token: ${{ github.token }}
|
|
|
|
# Security Scanning with gosec
|
|
- name: Run gosec Security Scanner
|
|
uses: securego/gosec@424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f # v2.22.11
|
|
with:
|
|
args: "-fmt sarif -out gosec-results.sarif ./..."
|
|
|
|
- name: Upload gosec results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@1b168cd39490f61582a9beae412bb7057a6b2c4e # v4.31.8
|
|
if: always()
|
|
with:
|
|
sarif_file: gosec-results.sarif
|
|
|
|
# Dependency Vulnerability Scanning
|
|
- name: Run govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck -json ./... > govulncheck-results.json || true
|
|
|
|
- name: Parse govulncheck results
|
|
run: |
|
|
if [ -s govulncheck-results.json ]; then
|
|
echo "::warning::Vulnerability check completed. Check govulncheck-results.json for details."
|
|
if grep -i -q '"finding"' govulncheck-results.json; then
|
|
echo "::error::Vulnerabilities found in dependencies!"
|
|
cat govulncheck-results.json
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Makefile Linting
|
|
- name: Run checkmake on Makefile
|
|
run: |
|
|
go install github.com/checkmake/checkmake/cmd/checkmake@latest
|
|
checkmake --config=.checkmake Makefile
|
|
|
|
# Shell Script Formatting Check
|
|
- name: Check shell script formatting
|
|
run: |
|
|
go install mvdan.cc/sh/v3/cmd/shfmt@latest
|
|
shfmt -d .
|
|
|
|
- name: Run YAML linting
|
|
uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1
|
|
with:
|
|
file_or_dir: .
|
|
strict: true
|
|
|
|
# Docker Security (if Dockerfile exists)
|
|
- name: Run Docker security scan
|
|
if: hashFiles('Dockerfile') != ''
|
|
run: |
|
|
docker run --rm -v "$PWD":/workspace \
|
|
aquasec/trivy:latest fs --security-checks vuln,config /workspace/Dockerfile || true
|
|
|
|
# Upload artifacts for review
|
|
- name: Upload security scan results
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
|
|
if: always()
|
|
with:
|
|
name: security-scan-results
|
|
path: |
|
|
gosec-results.sarif
|
|
govulncheck-results.json
|
|
retention-days: 30
|