Security Scanning & Analysis #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning & Analysis | |
| on: | |
| schedule: | |
| # Run security scans daily at 2 AM UTC | |
| - cron: '0 2 * * *' | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main ] | |
| workflow_dispatch: | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run npm audit | |
| run: npm audit --audit-level=moderate | |
| continue-on-error: true | |
| - name: Run Snyk to check for vulnerabilities | |
| uses: snyk/actions/node@master | |
| continue-on-error: true | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: --severity-threshold=high | |
| codeql-analysis: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'javascript' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| secrets-scan: | |
| name: Secrets Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run TruffleHog OSS | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: main | |
| head: HEAD | |
| extra_args: --debug --only-verified | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| security-scorecard: | |
| name: OSSF Scorecard Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| id-token: write | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@v2.3.1 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload SARIF file to GitHub | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: results.sarif | |
| npm-lockfile-updates: | |
| name: Check for npm lockfile updates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| cache: 'npm' | |
| - name: Check for outdated dependencies | |
| run: npm outdated || true | |
| - name: Check for package-lock.json updates | |
| run: | | |
| npm ci | |
| npm audit --audit-level=moderate --json > audit-report.json || true | |
| if [ -s audit-report.json ]; then | |
| echo "Security vulnerabilities found" | |
| cat audit-report.json | |
| fi | |
| electron-security-check: | |
| name: Electron Security Configuration Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Check Electron security configuration | |
| run: | | |
| # Check for common Electron security issues | |
| echo "Checking Electron security configuration..." | |
| # Check if nodeIntegration is disabled | |
| if grep -r "nodeIntegration.*true" src/; then | |
| echo "::warning::nodeIntegration should be disabled in renderer process" | |
| fi | |
| # Check if contextIsolation is enabled | |
| if grep -r "contextIsolation.*false" src/; then | |
| echo "::warning::contextIsolation should be enabled" | |
| fi | |
| # Check for eval() usage | |
| if grep -r "eval(" src/ --include="*.js" --include="*.ts" --include="*.tsx"; then | |
| echo "::warning::eval() usage detected - review for security implications" | |
| fi | |
| # Check for unsafe HTML content | |
| if grep -r "dangerouslySetInnerHTML" src/ --include="*.tsx"; then | |
| echo "::warning::dangerouslySetInnerHTML detected - ensure proper sanitization" | |
| fi | |
| security-summary: | |
| name: Security Scan Summary | |
| runs-on: ubuntu-latest | |
| needs: [dependency-audit, codeql-analysis, secrets-scan] | |
| if: always() | |
| steps: | |
| - name: Security Summary | |
| run: | | |
| echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| # Dependency Audit Status | |
| if [ "${{ needs.dependency-audit.result }}" == "success" ]; then | |
| echo "✅ **Dependency Audit**: Passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ **Dependency Audit**: Failed or warnings found" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| # CodeQL Analysis Status | |
| if [ "${{ needs.codeql-analysis.result }}" == "success" ]; then | |
| echo "✅ **CodeQL Analysis**: Passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ **CodeQL Analysis**: Issues detected" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| # Secrets Scan Status | |
| if [ "${{ needs.secrets-scan.result }}" == "success" ]; then | |
| echo "✅ **Secrets Scan**: No secrets detected" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ **Secrets Scan**: Potential secrets detected" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "For detailed results, check the individual job outputs." >> $GITHUB_STEP_SUMMARY |