update #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - main | |
| - develop | |
| pull_request: | |
| branches: | |
| - master | |
| - main | |
| - develop | |
| schedule: | |
| # Run security scans daily at 2 AM UTC | |
| - cron: '0 2 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| dependency-scan: | |
| name: Dependency Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| component: | |
| - { name: 'backend', path: 'src/backend' } | |
| - { name: 'dashboard', path: 'src/dashboard' } | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.x' | |
| - name: Run npm audit | |
| working-directory: ${{ matrix.component.path }} | |
| run: | | |
| npm audit --audit-level=moderate || true | |
| npm audit --json > audit-${{ matrix.component.name }}.json || true | |
| continue-on-error: true | |
| - name: Upload audit results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: npm-audit-${{ matrix.component.name }} | |
| path: ${{ matrix.component.path }}/audit-${{ matrix.component.name }}.json | |
| retention-days: 30 | |
| codeql-analysis: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['javascript', 'typescript', 'python'] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| trivy-scan: | |
| name: Trivy Container Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| secret-scan: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: TruffleHog OSS | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| extra_args: --debug --only-verified | |
| docker-security: | |
| name: Docker Image Security Scan | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| image: | |
| - 'nginx' | |
| - 'elk/elasticsearch' | |
| - 'elk/logstash' | |
| - 'elk/kibana' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Build Docker image | |
| run: | | |
| if [ -f "docker/${{ matrix.image }}/Dockerfile" ]; then | |
| docker build -t test-${{ matrix.image }}:latest docker/${{ matrix.image }} | |
| else | |
| echo "Dockerfile not found for ${{ matrix.image }}, skipping" | |
| exit 0 | |
| fi | |
| - name: Run Trivy vulnerability scanner on image | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'test-${{ matrix.image }}:latest' | |
| format: 'table' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| continue-on-error: true | |
| security-summary: | |
| name: Security Summary | |
| needs: [dependency-scan, codeql-analysis, trivy-scan, secret-scan, docker-security] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Check security scan status | |
| run: | | |
| echo "## 🔒 Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "- Dependency Scan: ${{ needs.dependency-scan.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- CodeQL Analysis: ${{ needs.codeql-analysis.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- Trivy Scan: ${{ needs.trivy-scan.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- Secret Scan: ${{ needs.secret-scan.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- Docker Security: ${{ needs.docker-security.result }}" >> $GITHUB_STEP_SUMMARY | |
| if [ "${{ needs.dependency-scan.result }}" == "failure" ] || \ | |
| [ "${{ needs.codeql-analysis.result }}" == "failure" ] || \ | |
| [ "${{ needs.trivy-scan.result }}" == "failure" ] || \ | |
| [ "${{ needs.secret-scan.result }}" == "failure" ]; then | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "⚠️ Some security scans failed. Please review the results." >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "✅ All security scans completed successfully!" >> $GITHUB_STEP_SUMMARY | |
| fi |