OpenShell/.github/workflows/security-scan.yml at main · TheTechOddBug/OpenShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Security Scan

on:
  workflow_dispatch:
    inputs:
      candidate_ref:
        description: Release tag to scan; Codex runs only for pre-release tags
        required: true
        type: string
      stable_ref:
        description: Optional previous stable tag override for Codex
        default: ""
        type: string
      allow_full_bootstrap:
        description: Allow a full Codex scan when no previous stable tag exists
        default: false
        type: boolean
      fail-on-codex-findings:
        description: Fail when Codex Security reports findings
        default: true
        type: boolean
      fail-on-static-findings:
        description: Fail when CodeQL, Trivy, or Zizmor reports HIGH/CRITICAL findings
        default: true
        type: boolean
      images:
        description: Newline-separated image references for Trivy
        default: ""
        type: string
      charts:
        description: Newline-separated packaged Helm chart OCI references for Trivy
        default: ""
        type: string
  workflow_call:
    inputs:
      candidate_ref:
        description: Release tag to scan; Codex runs only for pre-release tags
        required: true
        type: string
      stable_ref:
        description: Optional previous stable tag override for Codex
        default: ""
        type: string
      allow_full_bootstrap:
        description: Allow a full Codex scan when no previous stable tag exists
        default: false
        type: boolean
      fail-on-codex-findings:
        description: Fail when Codex Security reports findings
        default: true
        type: boolean
      fail-on-static-findings:
        description: Fail when CodeQL, Trivy, or Zizmor reports HIGH/CRITICAL findings
        default: true
        type: boolean
      images:
        description: Newline-separated image references for Trivy
        default: ""
        type: string
      charts:
        description: Newline-separated packaged Helm chart OCI references for Trivy
        default: ""
        type: string
    secrets:
      CODEX_SECURITY_API_KEY:
        required: true
      CACHIX_AUTH_TOKEN:
        required: false

permissions:
  contents: read

# Only the finding threshold is overridable; execution failures remain fatal.
jobs:
  codex:
    name: Codex Security
    if: contains(inputs.candidate_ref, '-pre.')
    uses: ./.github/workflows/codex-security.yml
    permissions:
      actions: read
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      stable_ref: ${{ inputs.stable_ref }}
      allow_full_bootstrap: ${{ inputs.allow_full_bootstrap }}
      fail-on-findings: ${{ inputs.fail-on-codex-findings }}
      upload_sarif: true
    secrets:
      CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}

  codeql:
    name: CodeQL
    uses: ./.github/workflows/codeql.yml
    permissions:
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}

  trivy:
    name: Trivy
    uses: ./.github/workflows/trivy-scan.yml
    permissions:
      contents: read
      packages: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}
      severity: HIGH,CRITICAL
      ignore-unfixed: false
      images: ${{ inputs.images }}
      charts: ${{ inputs.charts }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  cargo-deny:
    name: Cargo Deny
    uses: ./.github/workflows/cargo-deny.yml
    permissions:
      contents: read
      packages: read
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      advisories-only: true

  workflow-security:
    name: Actionlint and Zizmor
    uses: ./.github/workflows/workflow-security.yml
    permissions:
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}