Skip to content

security

security #42

Workflow file for this run

name: security
on:
push:
branches: [master, main, ]
pull_request:
branches: [master,main]
schedule:
- cron: '0 5 * * 6'
jobs:
msdefender:
runs-on: ubuntu-latest
steps:
-
name: Checkout repository
uses: actions/checkout@v3
-
name: Setup dotnet
uses: actions/setup-dotnet@v1
-
name: Run Microsoft Security DevOps
uses: microsoft/security-devops-action@preview
id: msdo
-
name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: ${{ steps.msdo.outputs.sarifFile }}
codeql:
name: codeql
runs-on: ubuntu-latest
steps:
-
name: Checkout repository
uses: actions/checkout@v3
-
name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: go
-
name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
govulncheck:
name: govulncheck
runs-on: ubuntu-latest
steps:
-
name: Checkout repository
uses: actions/checkout@v3
-
id: vars
run: |
goVersion=$(grep '^FROM go' .github/go/Dockerfile | cut -d ' ' -f 2 | cut -d ':' -f 2)
echo "go_version=${goVersion}" >> "$GITHUB_OUTPUT"
echo "Using Go version ${goVersion}"
-
name: Set up Go
uses: actions/setup-go@v3
with:
go-version: ${{ steps.vars.outputs.go_version }}
-
name: check for go vulnerabilities
uses: kmulvey/govulncheck-action@main
with:
packages: ./...
trivy:
name: trivy
runs-on: ubuntu-latest
steps:
-
uses: actions/checkout@v3
-
name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
hide-progress: false
exit-code: 0
ignore-unfixed: true
scan-type: 'fs'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH,MEDIUM'
-
name: Upload Trivy scan results to GitHub Security tab
if: always()
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'