security.yml

name: Security

on:
  workflow_dispatch:
  schedule:
    - cron: '0 12 * * *'
  push:
    branches:
      - 'main'
      - 'renovate/**'
    tags:
      - 'v*.*.*'
  pull_request:
    branches:
      - 'main'

permissions:
  contents: read

jobs:
  govulncheck:
    name: Govulncheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout GitHub Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Analyze source code
        uses: golang/govulncheck-action@dd0578b371c987f96d1185abb54344b44352bd58 # v1.0.3
        with:
          go-version-file: './go.mod'
          repo-checkout: false

  trivy:
    name: Trivy
    if: ${{ github.event.schedule || (github.event_name == 'push' && github.ref_name == 'main') }}
    runs-on: ubuntu-latest
    permissions:
      # For actions/checkout to fetch code
      contents: read
      # For github/codeql-action/upload-sarif to upload SARIF results
      security-events: write
    steps:
      - name: Checkout GitHub Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Build image from Dockerfile
        run: |
          docker build --tag juanjjaramillo/testbed:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
        with:
          image-ref: 'juanjjaramillo/testbed:${{ github.sha }}'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
        with:
          sarif_file: 'trivy-results.sarif'

  openssf:
    name: OpenSSF Scorecard
    if: ${{ github.event.schedule || (github.event_name == 'push' && github.ref_name == 'main') }}
    runs-on: ubuntu-latest
    permissions:
      # Needed to publish results and get a badge (see publish_results below)
      id-token: write
      # For actions/checkout to fetch code
      contents: read
      # For github/codeql-action/upload-sarif to upload SARIF results
      security-events: write

    steps:
      - name: Checkout GitHub Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          persist-credentials: false

      - name: Run analysis
        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
        with:
          results_file: results.sarif
          results_format: sarif
          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
          # - you want to enable the Branch-Protection check on a *public* repository, or
          # - you are installing Scorecard on a *private* repository
          # To create the PAT, follow the steps in
          # https://github.com/ossf/scorecard-action#authentication-with-pat
          repo_token: ${{ secrets.SCORECARD_TOKEN }}

          # Public repositories:
          #   - Publish results to OpenSSF REST API for easy access by consumers
          #   - Allows the repository to include the Scorecard badge.
          #   - See https://github.com/ossf/scorecard-action#publishing-results
          # For private repositories:
          #   - `publish_results` will always be set to `false`, regardless
          #     of the value entered here
          publish_results: true

      - name: Upload artifact
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
        with:
          name: SARIF file
          path: results.sarif
          retention-days: 5

      - name: Upload OSSF Scorecard scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
        with:
          sarif_file: results.sarif