Derive broker key from node identity and drop env key path #145
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Run weekly on Mondays at 9am UTC | |
| - cron: '0 9 * * 1' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| go-vulnerability-scan: | |
| name: Go Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: sdn-server | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.21' | |
| cache-dependency-path: sdn-server/go.sum | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck | |
| run: | | |
| echo "=== Go Vulnerability Scan Results ===" | |
| govulncheck ./... 2>&1 | tee govulncheck-report.txt | |
| exit_code=${PIPESTATUS[0]} | |
| echo "" | |
| echo "=== Scan Complete ===" | |
| if [ $exit_code -ne 0 ]; then | |
| echo "::warning::Vulnerabilities found in Go dependencies" | |
| fi | |
| # Don't fail the build, just report | |
| exit 0 | |
| - name: Upload govulncheck report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: govulncheck-report | |
| path: sdn-server/govulncheck-report.txt | |
| retention-days: 30 | |
| npm-audit: | |
| name: npm Dependency Audit | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: sdn-js | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| cache-dependency-path: sdn-js/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run npm audit | |
| run: | | |
| echo "=== npm Dependency Audit Results ===" | |
| npm audit --json > npm-audit-report.json 2>&1 || true | |
| npm audit 2>&1 | tee npm-audit-report.txt || true | |
| echo "" | |
| echo "=== Audit Summary ===" | |
| # Check for high/critical vulnerabilities | |
| high_count=$(cat npm-audit-report.json | jq '.metadata.vulnerabilities.high // 0' 2>/dev/null || echo "0") | |
| critical_count=$(cat npm-audit-report.json | jq '.metadata.vulnerabilities.critical // 0' 2>/dev/null || echo "0") | |
| echo "High vulnerabilities: $high_count" | |
| echo "Critical vulnerabilities: $critical_count" | |
| if [ "$critical_count" != "0" ] || [ "$high_count" != "0" ]; then | |
| echo "::warning::Found $high_count high and $critical_count critical vulnerabilities" | |
| fi | |
| echo "=== Audit Complete ===" | |
| - name: Upload npm audit report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: npm-audit-report | |
| path: | | |
| sdn-js/npm-audit-report.txt | |
| sdn-js/npm-audit-report.json | |
| retention-days: 30 | |
| docker-scan: | |
| name: Docker Image Scan | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| dockerfile: | |
| - path: deployment/docker/Dockerfile.full | |
| name: full-node | |
| - path: deployment/docker/Dockerfile.edge | |
| name: edge-relay | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check if Dockerfile exists | |
| id: check | |
| run: | | |
| if [ -f "${{ matrix.dockerfile.path }}" ]; then | |
| echo "exists=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "exists=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Set up Docker Buildx | |
| if: steps.check.outputs.exists == 'true' | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build Docker image | |
| if: steps.check.outputs.exists == 'true' | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ${{ matrix.dockerfile.path }} | |
| push: false | |
| load: true | |
| tags: sdn-${{ matrix.dockerfile.name }}:scan | |
| - name: Run Trivy vulnerability scanner | |
| if: steps.check.outputs.exists == 'true' | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: sdn-${{ matrix.dockerfile.name }}:scan | |
| format: 'table' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| output: 'trivy-${{ matrix.dockerfile.name }}-report.txt' | |
| - name: Display Trivy scan results | |
| if: steps.check.outputs.exists == 'true' | |
| run: | | |
| echo "=== Docker Image Scan Results for ${{ matrix.dockerfile.name }} ===" | |
| cat trivy-${{ matrix.dockerfile.name }}-report.txt || echo "No report generated" | |
| - name: Upload Trivy report | |
| if: steps.check.outputs.exists == 'true' && always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: trivy-${{ matrix.dockerfile.name }}-report | |
| path: trivy-${{ matrix.dockerfile.name }}-report.txt | |
| retention-days: 30 | |
| codeql-analysis: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['go', 'javascript'] | |
| include: | |
| - language: go | |
| working-directory: sdn-server | |
| - language: javascript | |
| working-directory: sdn-js | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-and-quality | |
| - name: Set up Go | |
| if: matrix.language == 'go' | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.21' | |
| cache-dependency-path: sdn-server/go.sum | |
| - name: Build Go code | |
| if: matrix.language == 'go' | |
| working-directory: sdn-server | |
| run: | | |
| go mod download | |
| go build ./... | |
| - name: Set up Node.js | |
| if: matrix.language == 'javascript' | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| cache-dependency-path: sdn-js/package-lock.json | |
| - name: Build JavaScript code | |
| if: matrix.language == 'javascript' | |
| working-directory: sdn-js | |
| run: | | |
| npm ci | |
| npm run build || true | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| security-summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [go-vulnerability-scan, npm-audit, docker-scan, codeql-analysis] | |
| if: always() | |
| steps: | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: reports | |
| continue-on-error: true | |
| - name: Generate summary | |
| run: | | |
| echo "# Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "## Job Status" >> $GITHUB_STEP_SUMMARY | |
| echo "| Scan | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| Go Vulnerability Scan | ${{ needs.go-vulnerability-scan.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| npm Audit | ${{ needs.npm-audit.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Docker Scan | ${{ needs.docker-scan.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| CodeQL Analysis | ${{ needs.codeql-analysis.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "## Reports" >> $GITHUB_STEP_SUMMARY | |
| echo "Detailed reports are available as workflow artifacts." >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Go Vulnerabilities" >> $GITHUB_STEP_SUMMARY | |
| if [ -f reports/govulncheck-report/govulncheck-report.txt ]; then | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| head -50 reports/govulncheck-report/govulncheck-report.txt >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "No report available" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### npm Audit" >> $GITHUB_STEP_SUMMARY | |
| if [ -f reports/npm-audit-report/npm-audit-report.txt ]; then | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| head -50 reports/npm-audit-report/npm-audit-report.txt >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "No report available" >> $GITHUB_STEP_SUMMARY | |
| fi |