Repository navigation
build(deps): bump the github-actions group with 4 updates #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container Vulnerability Scanning | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 2 * * 1' # weekly scan, every Monday 02:00 UTC | |
| jobs: | |
| container-scan: | |
| name: Container Vulnerability Scanning | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # required for uploading results to github security | |
| env: | |
| IMAGE_NAME: platform-backend:testing | |
| CONTAINER_SCAN_MERGED_SARIF_OUTPUT: container-scan-platform-backend-merged.sarif | |
| # SCA / CVE | |
| TRIVY_IGNOREFILE: ci/suppress_trivy.yaml | |
| OSV_IGNOREFILE: ci/suppress_osv_scanner.toml | |
| TRIVY_SCA_SARIF_OUTPUT: sca-trivy-container.sarif | |
| OSV_SCA_SARIF_OUTPUT: sca-osv-container.sarif | |
| # SAST / Linting | |
| SEMGREP_CONFIG_RULESETS: >- | |
| semgrep-rules/dockerfile auto | |
| OPENGREP_SAST_SARIF_OUTPUT: sast-opengrep-dockerfile.sarif | |
| HADOLINT_SAST_SARIF_OUTPUT: sast-hadolint-dockerfile.sarif | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 #v7.0.0 | |
| with: | |
| # renovate: datasource=python-version depName=python | |
| python-version: '3.14.7' | |
| - name: Build Docker image | |
| run: docker build -t ${{ env.IMAGE_NAME }} . | |
| - name: Setup tools | |
| run: | | |
| bash ci/setup-tools.sh \ | |
| --install-tool trivy,osv-scanner,opengrep,hadolint,semgrep-rules | |
| - name: Run SAST scanning | |
| run: python ci/container_scan.py --scan-type sast | |
| - name: Run SCA scanning | |
| if: ${{ !cancelled() }} | |
| run: python ci/container_scan.py --scan-type sca --image ${{ env.IMAGE_NAME }} | |
| - name: Merge all SARIF reports | |
| if: ${{ !cancelled() }} | |
| run: | | |
| python ci/container_scan.py \ | |
| --merge-sarif "${{ env.TRIVY_SCA_SARIF_OUTPUT }}" "${{ env.OSV_SCA_SARIF_OUTPUT }}" "${{ env.OPENGREP_SAST_SARIF_OUTPUT }}" "${{ env.HADOLINT_SAST_SARIF_OUTPUT }}" \ | |
| --merge-output "${{ env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT }}" | |
| - name: Upload merged SARIF to GitHub Security tab | |
| if: ${{ !cancelled() && hashFiles(env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT) != '' }} | |
| uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.31.2 | |
| with: | |
| sarif_file: ${{ env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT }} | |
| category: container-scan | |
| - name: Encrypt SARIF report | |
| id: encrypt | |
| if: ${{ !cancelled() && hashFiles(env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT) != '' }} | |
| env: | |
| PW: ${{ secrets.ARTIFACT_PASSWORD }} | |
| OUT: ${{ env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT }}.gpg | |
| run: | | |
| if [ -z "$PW" ]; then | |
| echo "::warning title=SARIF report not uploaded::ARTIFACT_PASSWORD is not available in this run (Dependabot, Renovate or fork PR). Skipping encryption and upload." | |
| rm -f -- "$CONTAINER_SCAN_MERGED_SARIF_OUTPUT" | |
| exit 0 | |
| fi | |
| printf '%s' "$PW" | gpg --symmetric --batch --yes --quiet \ | |
| --pinentry-mode loopback --passphrase-fd 0 \ | |
| --no-symkey-cache \ | |
| --cipher-algo AES256 \ | |
| --s2k-mode 3 --s2k-digest-algo SHA512 --s2k-count 65011712 \ | |
| --output "$OUT" -- "$CONTAINER_SCAN_MERGED_SARIF_OUTPUT" | |
| rm -f -- "$CONTAINER_SCAN_MERGED_SARIF_OUTPUT" | |
| echo "encrypted=$OUT" >> "$GITHUB_OUTPUT" | |
| - name: Upload encrypted SARIF artifact | |
| if: ${{ !cancelled() && steps.encrypt.outputs.encrypted != '' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: container-scan-sarif-report | |
| path: ${{ steps.encrypt.outputs.encrypted }} | |
| retention-days: 30 | |
| if-no-files-found: error |