Security #10

	name: Security

	on:
	push:
	branches: [ main, develop ]
	pull_request:
	branches: [ main, develop ]
	schedule:
	- cron: '0 0 * * 0' # Weekly on Sunday

	jobs:
	gosec:
	name: Security Scan (gosec)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Run gosec
	uses: securego/gosec@master
	with:
	args: '-no-fail -fmt sarif -out results.sarif ./...'

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: results.sarif

	dependency-check:
	name: Dependency Check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v4
	with:
	go-version: '1.22'

	- name: Run govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	govulncheck ./...

	trivy:
	name: Trivy Scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'sarif'
	output: 'trivy-results.sarif'

	- name: Upload Trivy results to GitHub Security
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: 'trivy-results.sarif'

Navigation Menu