Security #99
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| workflow_dispatch: | |
| push: | |
| paths: | |
| - 'src/**' | |
| - '.github/workflows/security.yml' | |
| - '.gitleaks.toml' | |
| pull_request: | |
| branches: [master, main] | |
| paths: | |
| - 'src/**' | |
| - '.github/workflows/security.yml' | |
| - '.gitleaks.toml' | |
| schedule: | |
| # Run bi-weekly on 1st and 15th | |
| - cron: '0 0 1,15 * *' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| gitleaks: | |
| name: Secrets Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Gitleaks | |
| run: | | |
| GITLEAKS_VERSION="8.21.2" | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz | |
| sudo mv gitleaks /usr/local/bin/ | |
| - name: Run Gitleaks | |
| run: | | |
| # Scan only current tree with custom config for template file exclusions | |
| gitleaks detect --source . --no-git --config .gitleaks.toml --verbose --redact --exit-code 1 || { | |
| echo "::warning::Gitleaks found potential secrets. Review the output above." | |
| exit 1 | |
| } | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: c-cpp | |
| queries: +security-extended | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential libmariadb-dev libssl-dev zlib1g-dev autoconf automake libtool libgd-dev libcurl4-openssl-dev libjson-c-dev | |
| - name: Copy config headers | |
| run: | | |
| cp src/campaign.example.h src/campaign.h | |
| cp src/mud_options.example.h src/mud_options.h | |
| cp src/vnums.example.h src/vnums.h | |
| - name: Configure with autotools | |
| run: | | |
| autoreconf -fvi | |
| ./configure | |
| - name: Build for CodeQL | |
| run: make -j"$(nproc)" | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:c-cpp" | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| # Allow reviewing any manifest files if present | |
| allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, GPL-2.0, LGPL-2.1 |