77 lines
2.1 KiB
YAML
77 lines
2.1 KiB
YAML
name: Security
|
|
description: Security scanning per service/platform/environment.
|
|
inputs:
|
|
service:
|
|
description: Target service name
|
|
required: true
|
|
platform:
|
|
description: Target platform (e.g., linux/amd64)
|
|
required: true
|
|
environment:
|
|
description: Deployment environment (dev or prod)
|
|
required: true
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Prepare matrix context
|
|
id: matrix
|
|
uses: ./.github/actions/matrix-support
|
|
with:
|
|
service: ${{ inputs.service }}
|
|
platform: ${{ inputs.platform }}
|
|
environment: ${{ inputs.environment }}
|
|
|
|
- name: Run golangci-lint
|
|
if: inputs.service != 'dashboard'
|
|
uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6.2.0
|
|
with:
|
|
version: latest
|
|
args: ./...
|
|
|
|
- name: Install gosec
|
|
if: inputs.service != 'dashboard'
|
|
shell: bash
|
|
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
|
|
|
|
- name: Run gosec
|
|
if: inputs.service != 'dashboard'
|
|
shell: bash
|
|
run: gosec ./...
|
|
|
|
- name: Trivy filesystem scan
|
|
if: inputs.service != 'dashboard'
|
|
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: true
|
|
format: table
|
|
exit-code: "0"
|
|
|
|
- name: Install dashboard dependencies
|
|
if: inputs.service == 'dashboard'
|
|
working-directory: dashboard
|
|
shell: bash
|
|
run: yarn install --frozen-lockfile
|
|
|
|
- name: Run ESLint
|
|
if: inputs.service == 'dashboard'
|
|
working-directory: dashboard
|
|
shell: bash
|
|
run: yarn lint
|
|
|
|
- name: Semgrep security rules
|
|
if: inputs.service == 'dashboard'
|
|
uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1
|
|
with:
|
|
config: p/ci
|
|
paths: dashboard
|
|
|
|
- name: npm audit (production)
|
|
if: inputs.service == 'dashboard'
|
|
working-directory: dashboard
|
|
shell: bash
|
|
run: npm audit --production
|
|
continue-on-error: true
|