add security scan flow #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| ############################################### | |
| # 1. Detect repository languages dynamically | |
| ############################################### | |
| detect-languages: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| languages: ${{ steps.detect.outputs.languages }} | |
| steps: | |
| - name: Detect languages from GitHub API | |
| id: detect | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const repo = context.repo; | |
| const res = await github.rest.repos.listLanguages({ | |
| owner: repo.owner, | |
| repo: repo.repo | |
| }); | |
| const langMap = res.data; | |
| const supported = { | |
| "JavaScript": "javascript", | |
| "TypeScript": "javascript", | |
| "Python": "python", | |
| "Go": "go", | |
| "Ruby": "ruby", | |
| "Java": "java", | |
| "PHP": "cpp", // CodeQL uses C/C++ for PHP security (closest match) | |
| "C": "cpp", | |
| "C++": "cpp" | |
| }; | |
| const detected = Object.keys(langMap) | |
| .filter(lang => supported[lang]) | |
| .map(lang => supported[lang]); | |
| if (detected.length === 0) { | |
| detected.push("javascript"); // default fallback | |
| } | |
| return { | |
| languages: JSON.stringify([...new Set(detected)]) | |
| }; | |
| ############################################### | |
| # 2. Run GITLEAKS (strong secret scanner) | |
| ############################################### | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| with: | |
| args: detect --source . --verbose --redact | |
| ############################################### | |
| # 3. Run CodeQL using auto-detected languages | |
| ############################################### | |
| codeql: | |
| needs: [detect-languages] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| language: ${{ fromJson(needs.detect-languages.outputs.languages) }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 |