git.iko.soy/crush
on 2faa467 help sign in
crush/.github/workflows/security.yml
92 lines 2.9 kB history raw
1name: "security"
3on:
4 pull_request:
5 push:
6 branches: [main]
7 schedule:
8 - cron: "0 2 * * *"
10permissions:
11 contents: read
13concurrency:
14 group: security-${{ github.event.pull_request.number || github.ref }}
15 cancel-in-progress: true
17jobs:
18 codeql:
19 runs-on: ubuntu-latest
20 strategy:
21 fail-fast: false
22 matrix:
23 language: ["go", "actions"]
24 permissions:
25 actions: read
26 contents: read
27 pull-requests: read
28 security-events: write
29 steps:
30 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31 with:
32 persist-credentials: false
33 - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
34 with:
35 languages: ${{ matrix.language }}
36 - uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
37 - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
39 grype:
40 runs-on: ubuntu-latest
41 permissions:
42 security-events: write
43 actions: read
44 contents: read
45 steps:
46 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47 with:
48 persist-credentials: false
49 - uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
50 id: scan
51 with:
52 path: "."
53 fail-build: true
54 severity-cutoff: critical
55 - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
56 with:
57 sarif_file: ${{ steps.scan.outputs.sarif }}
59 govulncheck:
60 runs-on: ubuntu-latest
61 permissions:
62 security-events: write
63 contents: read
64 steps:
65 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
66 with:
67 persist-credentials: false
68 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
69 with:
70 go-version: stable
71 - name: Install govulncheck
72 run: go install golang.org/x/vuln/cmd/govulncheck@latest
73 - name: Run govulncheck
74 run: |
75 govulncheck -C . -format sarif ./... > results.sarif
76 - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
77 with:
78 sarif_file: results.sarif
80 dependency-review:
81 runs-on: ubuntu-latest
82 if: github.event_name == 'pull_request'
83 permissions:
84 contents: read
85 steps:
86 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
87 with:
88 persist-credentials: false
89 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
90 with:
91 fail-on-severity: critical
92 allow-licenses: BSD-2-Clause, BSD-3-Clause, MIT, MIT-0, Apache-2.0, MPL-2.0, ISC, LicenseRef-scancode-google-patent-license-golang, Unlicense