security #54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 6 * * 1" # weekly Monday 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| GO_VERSION: "1.26" | |
| jobs: | |
| detect: | |
| name: detect go source | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has-source: ${{ steps.detect.outputs.has-source }} | |
| steps: | |
| - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - id: detect | |
| shell: bash | |
| run: | | |
| if find . -name '*.go' -not -path './.*' -not -path './vendor/*' -not -path '*/testdata/*' -print -quit | grep -q .; then | |
| echo "has-source=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has-source=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| gosec: | |
| name: gosec | |
| needs: detect | |
| if: needs.detect.outputs.has-source == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: securego/gosec@9e6a9843d7a4a6e3e9a8539b02612c8a4aa3f889 # v2.27.1 | |
| with: | |
| args: -fmt sarif -out gosec.sarif -no-fail ./... | |
| - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| sarif_file: gosec.sarif | |
| category: gosec | |
| govulncheck: | |
| name: govulncheck | |
| needs: detect | |
| # govulncheck scans Go source; it returns "no packages matched the provided | |
| # patterns" and exits 1 on an empty source tree. Gate on detect.has-source | |
| # so the job is a no-op until phase 3 (#4) lands the first .go file. | |
| if: needs.detect.outputs.has-source == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: govulncheck | |
| run: go tool govulncheck ./... | |
| semgrep: | |
| name: semgrep | |
| needs: detect | |
| if: needs.detect.outputs.has-source == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| container: | |
| # semgrep/semgrep:1.161.0 (multi-arch manifest list digest) | |
| image: semgrep/semgrep@sha256:326e5f41cc972bb423b764a14febbb62bbad29ee1c01820805d077dd868fea48 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Semgrep | |
| run: | | |
| semgrep \ | |
| --config=p/security-audit \ | |
| --config=p/secrets \ | |
| --config=p/golang \ | |
| --config=p/owasp-top-ten \ | |
| --sarif --output=semgrep.sarif \ | |
| --error \ | |
| . | |
| - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| if: always() | |
| with: | |
| sarif_file: semgrep.sarif | |
| category: semgrep | |
| trivy: | |
| name: trivy fs | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| format: sarif | |
| output: trivy.sarif | |
| ignore-unfixed: true | |
| exit-code: "0" # report findings; do not fail the build directly. SARIF gates are visible via security tab. | |
| - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| if: always() | |
| with: | |
| sarif_file: trivy.sarif | |
| category: trivy |