security.yml

name: "Security"
on:
  workflow_dispatch:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]
  schedule:
    - cron: '30 12 * * 3'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.event_name != 'workflow_dispatch' }}

permissions: { }

jobs:
  gosec:
    name: gosec check
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    # Skip any created PR or push by dependabot to avoid permission issues
    if: |
      github.event.pull_request.user.login != 'dependabot[bot]' &&
        (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == 'wavesplatform/gowaves')
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
        with:
          persist-credentials: false
      - name: Run gosec security scanner
        uses: securego/gosec@223e19b8856e00f02cc67804499a83f77e208f3c # v2.25.0
        with:
          # with '-no-fail' we let the report trigger content trigger a failure using the GitHub Security features.
          args: "-no-fail -exclude-generated -fmt sarif -out gosec.sarif ./..."
      - name: Transform gosec SARIF to meet SARIF 2.1.0 schema requirements
        # Produces SARIF file has two incompatibilities with SARIF 2.1.0 schema all of them are in `fixes` object:
        #  1. Field `description` contains only `markdown` property, but `text` property is mandatory.
        #  2. Property `artifactChanges` must be non-empty array with valid `artifactChange` object.
        # To fix those issues the first part of jq query copies content of `markdown` field into `text` field
        # if it's not present. In the second part if the `fixes` object has null array as `artifactChanges` the empty
        # valid `artifactChange` object inserted.
        # After fix of mentioned gosec issues this step can be removed.
        run: |
          set -e
          jq 'walk(if type=="object" and has("markdown") and (.text == null or .text == "") then .text = .markdown else . end) | (.runs[].results[]? .fixes[]? .artifactChanges) |= (if . == null then [{"artifactLocation": { "uri": "" }, "replacements": [{"deletedRegion": {"byteOffset": 0, "byteLength": 0 }}]}] else . end)' gosec.sarif > gosec_fixed.sarif
          jq empty gosec_fixed.sarif
          mv gosec_fixed.sarif gosec.sarif
      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v3
        with:
          sarif_file: gosec.sarif

  semgrep:
    name: semgrep scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    # Skip any created PR or push by dependabot to avoid permission issues and skip this check for PRs from forks
    if: |
      github.event.pull_request.user.login != 'dependabot[bot]' &&
        (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == 'wavesplatform/gowaves')
    container:
      image: docker://semgrep/semgrep@sha256:ab68a1c0fe35f41be66e2392903aeea64b6228c16456c8c7058275bbab4c297d
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
        with:
          persist-credentials: false
        # we let the report trigger content trigger a failure using the GitHub Security features.
        # see https://semgrep.dev/docs/cli-usage/#exit-codes for more details.
      - name: Run semgrep security scanner
        run: |
          cat << 'EOF' | bash
              semgrep ci --config="auto" --config="r/default" --config="r/go" --config="r/dgryski" \
                --config="r/trailofbits" --config="r/dockerfile" --config="r/bash" \
                --config="r/problem-based-packs" --config="r/generic" --config="r/yaml" --config="r/json" \
                --config="./.semgrep/rules" --sarif --dataflow-traces --output=semgrep.sarif --max-target-bytes=2MB
              EXIT_CODE=$?
              if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ]
              then
                exit 0
              else
                exit $EXIT_CODE
              fi
          EOF
      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v3
        with:
          sarif_file: semgrep.sarif

  vuln-scan:
    name: Vulnerability scanner
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
        with:
          persist-credentials: false
      - name: Set up Go
        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
        with:
          go-version: 1.25.x
          check-latest: true
          cache: true
      - name: Run go list
        run: go list -json -deps ./... > go.list
      - name: Nancy
        if: (github.repository == 'wavesplatform/gowaves' && github.event.pull_request.head.repo.fork != true)
        uses: sonatype-nexus-community/nancy-github-action@726e338312e68ecdd4b4195765f174d3b3ce1533 # v1.0.3
        with:
          nancyVersion: latest
          goListFile: go.list
          nancyCommand: sleuth --username ${{ vars.OSSINDEX_USER }} --token ${{ secrets.OSSINDEX_TOKEN }}
      - name: govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...