chore(deps): bump actions/checkout from 4 to 5 #75
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write # needed to upload SARIF | |
| concurrency: | |
| group: security-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| trivy-and-sbom: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| # === Optional: Install Trivy CLI === | |
| # Github's ubuntu-latest runner currently has Trivy pre-installed | |
| # Uncomment this if using a custom runner or if you need to pin a specific version | |
| # | |
| # - name: Install Trivy CLI (for SBOM) | |
| # run: | | |
| # sudo apt-get update -y | |
| # sudo apt-get install -y wget apt-transport-https gnupg lsb-release | |
| # wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo gpg --dearmor -o /usr/share/keyrings/trivy.gpg | |
| # echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list | |
| # sudo apt-get update -y | |
| # sudo apt-get install -y trivy | |
| # --- Trivy Action: produce SARIF for GitHub Code Scanning (always succeed) --- | |
| - name: Trivy (SARIF vuln + config) | |
| id: trivy_sarif | |
| uses: aquasecurity/trivy-action@0.32.0 | |
| continue-on-error: true | |
| with: | |
| scan-type: fs | |
| scanners: "vuln,config" | |
| ignore-unfixed: true | |
| severity: "HIGH,CRITICAL" # filter what goes to SARIF UI | |
| exit-code: "0" # never fail here; we gate separately | |
| format: "sarif" | |
| output: "trivy.sarif" | |
| - name: Upload SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: trivy.sarif | |
| # --- Setup Trivy CLI for SBOM + gating --- | |
| - name: Setup Trivy CLI | |
| if: always() | |
| uses: aquasecurity/setup-trivy@v0.2.3 | |
| # --- SBOM (always publish) --- | |
| - name: Generate SBOM (SPDX JSON) | |
| if: always() | |
| run: | | |
| echo "SBOM step: using trivy fs (spdx-json)" | |
| trivy fs --format spdx-json --output sbom.spdx.json . | |
| - name: Upload SBOM artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom-spdx | |
| path: sbom.spdx.json | |
| # --- Exec-friendly summary (Markdown) --- | |
| - name: Install jq (for JSON parsing) | |
| if: always() | |
| run: sudo apt-get update -y && sudo apt-get install -y jq | |
| - name: Generate Trivy JSON (HIGH/CRITICAL only) | |
| if: always() | |
| run: | | |
| trivy fs \ | |
| --scanners vuln,config \ | |
| --ignore-unfixed \ | |
| --severity HIGH,CRITICAL \ | |
| --format json \ | |
| --output trivy.high_critical.json \ | |
| . | |
| - name: Build security-summary.md | |
| if: always() | |
| run: | | |
| VULN_COUNT=$(jq '[.Results[]? | .Vulnerabilities[]?] | length' trivy.high_critical.json) | |
| MISCONF_COUNT=$(jq '[.Results[]? | .Misconfigurations[]?] | map(select(.Severity=="HIGH" or .Severity=="CRITICAL")) | length' trivy.high_critical.json) | |
| SBOM_STATUS="generated: sbom.spdx.json (artifact: sbom-spdx)" | |
| STATUS_EMOJI="✅" | |
| if [ "$VULN_COUNT" -gt 0 ] || [ "$MISCONF_COUNT" -gt 0 ]; then STATUS_EMOJI="❌"; fi | |
| { | |
| echo "# Security Summary" | |
| echo "" | |
| echo "- **Vulnerabilities (HIGH/CRITICAL):** $VULN_COUNT" | |
| echo "- **Misconfigurations (HIGH/CRITICAL):** $MISCONF_COUNT" | |
| echo "- **SBOM:** $SBOM_STATUS" | |
| echo "- **Code scanning:** see Security → Code scanning alerts" | |
| echo "" | |
| echo "**Overall status:** $STATUS_EMOJI" | |
| } > security-summary.md | |
| echo "----" | |
| echo "security-summary.md" | |
| cat security-summary.md | |
| - name: Upload Security Summary | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-summary | |
| path: security-summary.md | |
| # --- Explicit Gate: fail only if HIGH/CRITICAL exist --- | |
| - name: Gate on HIGH/CRITICAL (Trivy CLI) | |
| id: trivy_gate | |
| continue-on-error: true | |
| run: | | |
| echo "Gating on HIGH/CRITICAL only..." | |
| trivy fs --scanners vuln,config --ignore-unfixed --severity HIGH,CRITICAL --exit-code 1 . | |
| - name: Fail if HIGH/CRITICAL found | |
| if: steps.trivy_gate.outcome == 'failure' | |
| run: | | |
| echo "High/Critical findings detected by Trivy. Failing the job." | |
| exit 1 |