Skip to content

Commit 360c027

Browse files
anhthiianhthii
committed
Add vulnerabilties check in CI
1 parent e22a449 commit 360c027

1 file changed

Lines changed: 182 additions & 1 deletion

File tree

‎.github/workflows/ci.yml‎

Lines changed: 182 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,9 +60,190 @@ jobs:
6060
version: latest
6161
args: --timeout=5m
6262

63+
# Security vulnerability scanning
64+
security-scan:
65+
runs-on: ubuntu-latest
66+
name: Security Vulnerability Scan
67+
68+
steps:
69+
- name: Checkout code
70+
uses: actions/checkout@v4
71+
72+
- name: Set up Go
73+
uses: actions/setup-go@v4
74+
with:
75+
go-version: "1.23"
76+
77+
- name: Cache Go modules
78+
uses: actions/cache@v3
79+
with:
80+
path: |
81+
~/.cache/go-build
82+
~/go/pkg/mod
83+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
84+
restore-keys: |
85+
${{ runner.os }}-go-
86+
87+
- name: Install dependencies
88+
run: go mod download
89+
90+
- name: Install govulncheck
91+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
92+
93+
- name: Run govulncheck
94+
run: govulncheck ./...
95+
96+
- name: Install gosec
97+
run: go install github.com/securecodewarrior/gosec/v2/cmd/gosec@latest
98+
99+
- name: Run gosec security scanner
100+
run: gosec -fmt sarif -out gosec-results.sarif ./...
101+
102+
- name: Upload gosec results to GitHub Security tab
103+
uses: github/codeql-action/upload-sarif@v2
104+
if: always()
105+
with:
106+
sarif_file: gosec-results.sarif
107+
108+
# CodeQL Analysis
109+
codeql-analysis:
110+
name: CodeQL Analysis
111+
runs-on: ubuntu-latest
112+
permissions:
113+
actions: read
114+
contents: read
115+
security-events: write
116+
117+
strategy:
118+
fail-fast: false
119+
matrix:
120+
language: ['go']
121+
122+
steps:
123+
- name: Checkout code
124+
uses: actions/checkout@v4
125+
126+
- name: Initialize CodeQL
127+
uses: github/codeql-action/init@v2
128+
with:
129+
languages: ${{ matrix.language }}
130+
queries: +security-and-quality
131+
132+
- name: Set up Go
133+
uses: actions/setup-go@v4
134+
with:
135+
go-version: "1.23"
136+
137+
- name: Cache Go modules
138+
uses: actions/cache@v3
139+
with:
140+
path: |
141+
~/.cache/go-build
142+
~/go/pkg/mod
143+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
144+
restore-keys: |
145+
${{ runner.os }}-go-
146+
147+
- name: Install dependencies
148+
run: go mod download
149+
150+
- name: Build for CodeQL
151+
run: |
152+
go build -v ./cmd/mpcium
153+
go build -v ./cmd/mpcium-cli
154+
155+
- name: Perform CodeQL Analysis
156+
uses: github/codeql-action/analyze@v2
157+
with:
158+
category: "/language:${{matrix.language}}"
159+
160+
# SBOM Generation
161+
sbom:
162+
runs-on: ubuntu-latest
163+
name: Generate SBOM
164+
165+
steps:
166+
- name: Checkout code
167+
uses: actions/checkout@v4
168+
169+
- name: Set up Go
170+
uses: actions/setup-go@v4
171+
with:
172+
go-version: "1.23"
173+
174+
- name: Cache Go modules
175+
uses: actions/cache@v3
176+
with:
177+
path: |
178+
~/.cache/go-build
179+
~/go/pkg/mod
180+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
181+
restore-keys: |
182+
${{ runner.os }}-go-
183+
184+
- name: Install dependencies
185+
run: go mod download
186+
187+
- name: Build binaries
188+
run: |
189+
go build -o mpcium ./cmd/mpcium
190+
go build -o mpcium-cli ./cmd/mpcium-cli
191+
192+
- name: Install Syft
193+
run: |
194+
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
195+
196+
- name: Generate SBOM with Syft (SPDX-JSON)
197+
run: |
198+
syft . -o spdx-json=sbom.spdx.json
199+
200+
- name: Generate SBOM with Syft (CycloneDX)
201+
run: |
202+
syft . -o cyclonedx-json=sbom.cyclonedx.json
203+
204+
- name: Generate SBOM with Syft (Syft JSON)
205+
run: |
206+
syft . -o syft-json=sbom.syft.json
207+
208+
- name: Upload SBOM artifacts
209+
uses: actions/upload-artifact@v4
210+
with:
211+
name: sbom-files
212+
path: |
213+
sbom.spdx.json
214+
sbom.cyclonedx.json
215+
sbom.syft.json
216+
retention-days: 30
217+
218+
- name: Scan SBOM with Grype
219+
uses: anchore/scan-action@v3
220+
with:
221+
path: sbom.spdx.json
222+
fail-build: false
223+
output-format: sarif
224+
output-file: grype-results.sarif
225+
226+
- name: Upload Grype results to GitHub Security tab
227+
uses: github/codeql-action/upload-sarif@v2
228+
if: always()
229+
with:
230+
sarif_file: grype-results.sarif
231+
232+
- name: Display SBOM summary
233+
run: |
234+
echo "📦 SBOM Generation Summary"
235+
echo "========================="
236+
echo "Generated SBOM files:"
237+
ls -la sbom.*
238+
echo ""
239+
echo "SBOM package count:"
240+
echo "SPDX: $(jq '.packages | length' sbom.spdx.json)"
241+
echo "CycloneDX: $(jq '.components | length' sbom.cyclonedx.json)"
242+
echo "Syft: $(jq '.artifacts | length' sbom.syft.json)"
243+
63244
build:
64245
runs-on: ubuntu-latest
65-
needs: [test, lint]
246+
needs: [test, lint, security-scan, codeql-analysis, sbom]
66247

67248
steps:
68249
- name: Checkout code

0 commit comments

Comments
 (0)