| name: "security" |
|
|
| on: |
| pull_request: |
| push: |
| branches: [main] |
| schedule: |
| - cron: "0 2 * * *" |
|
|
| permissions: |
| contents: read |
|
|
| concurrency: |
| group: security-${{ github.event.pull_request.number || github.ref }} |
| cancel-in-progress: true |
|
|
| jobs: |
| codeql: |
| runs-on: ubuntu-latest |
| strategy: |
| fail-fast: false |
| matrix: |
| language: ["go", "actions"] |
| permissions: |
| actions: read |
| contents: read |
| pull-requests: read |
| security-events: write |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 |
| with: |
| persist-credentials: false |
| - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 |
| with: |
| languages: ${{ matrix.language }} |
| - uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 |
| - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 |
|
|
| grype: |
| runs-on: ubuntu-latest |
| permissions: |
| security-events: write |
| actions: read |
| contents: read |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 |
| with: |
| persist-credentials: false |
| - uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 |
| id: scan |
| with: |
| path: "." |
| fail-build: true |
| severity-cutoff: critical |
| - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 |
| with: |
| sarif_file: ${{ steps.scan.outputs.sarif }} |
|
|
| govulncheck: |
| runs-on: ubuntu-latest |
| permissions: |
| security-events: write |
| contents: read |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 |
| with: |
| persist-credentials: false |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e |
| with: |
| go-version: stable |
| - name: Install govulncheck |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest |
| - name: Run govulncheck |
| run: | |
| govulncheck -C . -format sarif ./... > results.sarif |
| - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 |
| with: |
| sarif_file: results.sarif |
|
|
| dependency-review: |
| runs-on: ubuntu-latest |
| if: github.event_name == 'pull_request' |
| permissions: |
| contents: read |
| steps: |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 |
| with: |
| persist-credentials: false |
| - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 |
| with: |
| fail-on-severity: critical |
| allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, MIT-0, Apache-2.0, MPL-2.0, ISC, LicenseRef-scancode-google-patent-license-golang, Unlicense, CC-BY-4.0 |
|
|
