Security #1487
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 12 * * *' | |
| push: | |
| branches: | |
| - 'main' | |
| - 'renovate/**' | |
| tags: | |
| - 'v*.*.*' | |
| pull_request: | |
| branches: | |
| - 'main' | |
| permissions: | |
| contents: read | |
| jobs: | |
| govulncheck: | |
| name: Govulncheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout GitHub Repository | |
| uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - name: Analyze source code | |
| uses: golang/govulncheck-action@dd0578b371c987f96d1185abb54344b44352bd58 # v1.0.3 | |
| with: | |
| go-version-file: './go.mod' | |
| repo-checkout: false | |
| trivy: | |
| name: Trivy | |
| if: ${{ github.event.schedule || (github.event_name == 'push' && github.ref_name == 'main') }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # For actions/checkout to fetch code | |
| contents: read | |
| # For github/codeql-action/upload-sarif to upload SARIF results | |
| security-events: write | |
| steps: | |
| - name: Checkout GitHub Repository | |
| uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| - name: Build image from Dockerfile | |
| run: | | |
| docker build --tag juanjjaramillo/testbed:${{ github.sha }} . | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@fd25fed6972e341ff0007ddb61f77e88103953c2 # 0.21.0 | |
| with: | |
| image-ref: 'juanjjaramillo/testbed:${{ github.sha }}' | |
| ignore-unfixed: true | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| openssf: | |
| name: OpenSSF Scorecard | |
| if: ${{ github.event.schedule || (github.event_name == 'push' && github.ref_name == 'main') }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # Needed to publish results and get a badge (see publish_results below) | |
| id-token: write | |
| # For actions/checkout to fetch code | |
| contents: read | |
| # For github/codeql-action/upload-sarif to upload SARIF results | |
| security-events: write | |
| steps: | |
| - name: Checkout GitHub Repository | |
| uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: | |
| # - you want to enable the Branch-Protection check on a *public* repository, or | |
| # - you are installing Scorecard on a *private* repository | |
| # To create the PAT, follow the steps in | |
| # https://github.com/ossf/scorecard-action#authentication-with-pat | |
| repo_token: ${{ secrets.SCORECARD_TOKEN }} | |
| # Public repositories: | |
| # - Publish results to OpenSSF REST API for easy access by consumers | |
| # - Allows the repository to include the Scorecard badge. | |
| # - See https://github.com/ossf/scorecard-action#publishing-results | |
| # For private repositories: | |
| # - `publish_results` will always be set to `false`, regardless | |
| # of the value entered here | |
| publish_results: true | |
| - name: Upload artifact | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| with: | |
| name: SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload OSSF Scorecard scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8 | |
| with: | |
| sarif_file: results.sarif |