ci-workflows/.github/workflows/scanner.yml at master · go-openapi/ci-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
name: Vulnerability scans

on:
  workflow_call:

  workflow_dispatch:

permissions:
  contents: read

# description: |
#   A fast vulnerability scan on the repo that effectively supplements ossf scorecard and codesql
#   and may run every day.
#
#   * trivy reports are often more easily actionable than codeql reports.
#   * govumnscan supplements this analysis with a more go-specific approach
#
# NOTE: at this moment, we don't want to adopt snyk, which requires a token, provides an extra dashboard etc.
# Most likely, snyk would be redundant with trivy.

jobs:
  analysis:
    name: Vulnerability scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      -
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      -
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: stable
          check-latest: true
          cache: true
      -
        name: Vulnerability scan by trivy
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: repo
          format: sarif
          hide-progress: false
          output: trivy-code-report.sarif
          scanners: vuln,secret
          version: v0.69.3
          exit-code: 0
      -
        name: Upload trivy findings to code scanning dashboard
        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: trivy
          sarif_file: trivy-code-report.sarif

  govulnscan:
    name: go vulnerability scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      -
        id: govulncheck
        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
        with:
          output-format: sarif
          output-file: govulnscan-report.sarif
      -
        name: Upload govulnscan findings to code scanning dashboard
        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
        with:
          category: govulnscan
          sarif_file: govulnscan-report.sarif