chore: if necessary user can pass a token to pull private libs during… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "PR Security Scan" | ||
|
Check failure on line 1 in .github/workflows/pr-security-scan.yml
|
||
| # This reusable workflow handles security scanning for pull requests | ||
| # It detects changed components and runs Trivy scans on them | ||
| on: | ||
| workflow_call: | ||
| inputs: | ||
| runner_type: | ||
| description: 'GitHub runner type to use' | ||
| type: string | ||
| default: 'ubuntu-latest' | ||
| filter_paths: | ||
| description: 'Paths to monitor for changes (newline separated)' | ||
| type: string | ||
| default: |- | ||
| components/onboarding | ||
| components/transaction | ||
| components/console | ||
| path_level: | ||
| description: 'Directory depth level to extract app name' | ||
| type: string | ||
| default: '2' | ||
| dockerhub_org: | ||
| description: 'DockerHub organization name' | ||
| type: string | ||
| default: 'lerianstudio' | ||
| secrets: | ||
| MANAGE_TOKEN: | ||
| description: 'GitHub token for accessing private repositories during Docker build' | ||
| required: false | ||
| permissions: | ||
| id-token: write # Required for OIDC authentication | ||
| contents: read # Required to checkout the repository | ||
| pull-requests: write # Allows commenting on PRs | ||
| security-events: write # Required for security scanning | ||
| jobs: | ||
| detect_changes: | ||
| runs-on: ${{ inputs.runner_type }} | ||
| outputs: | ||
| matrix: ${{ steps.changed-paths.outputs.matrix }} | ||
| name: Detect changed paths | ||
| steps: | ||
| - name: Get changed paths | ||
| id: changed-paths | ||
| uses: LerianStudio/github-actions-changed-paths@main | ||
| with: | ||
| filter_paths: |- | ||
| ${{ inputs.filter_paths }} | ||
| get_app_name: true | ||
| path_level: ${{ inputs.path_level }} | ||
| security_scan: | ||
| needs: detect_changes | ||
| if: needs.detect_changes.outputs.matrix != '[]' # Skip if no relevant changes | ||
| runs-on: ${{ inputs.runner_type }} | ||
| strategy: | ||
| max-parallel: 1 | ||
| fail-fast: false | ||
| matrix: | ||
| app: ${{ fromJson(needs.detect_changes.outputs.matrix) }} | ||
| env: | ||
| DOCKERHUB_ORG: ${{ inputs.dockerhub_org }} | ||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| # ----------------- Security Scans ----------------- | ||
| - name: Trivy Secret Scan - Repository (Table Output) | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| if: always() | ||
| with: | ||
| scan-type: fs | ||
| scan-ref: . | ||
| format: table | ||
| exit-code: '1' | ||
| hide-progress: true | ||
| security-checks: secret | ||
| skip-dirs: '.git,node_modules,dist,build,.next,coverage,vendor' | ||
| - name: Trivy Secret Scan - Repository (SARIF Output) | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| if: always() | ||
| with: | ||
| scan-type: fs | ||
| scan-ref: . | ||
| format: sarif | ||
| output: 'trivy-secret-scan-repo-${{ matrix.app.name }}.sarif' | ||
| exit-code: '0' | ||
| hide-progress: true | ||
| security-checks: secret | ||
| skip-dirs: '.git,node_modules,dist,build,.next,coverage,vendor' | ||
| - name: Build Docker Image for Scanning (with secrets) | ||
| if: secrets.MANAGE_TOKEN != '' | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| file: ${{ matrix.app.working_dir }}/Dockerfile | ||
| platforms: linux/amd64 | ||
| load: true | ||
| push: false | ||
| tags: ${{ env.DOCKERHUB_ORG }}/${{ matrix.app.name }}:pr-scan-${{ github.sha }} | ||
| secrets: | | ||
| github_token=${{ secrets.MANAGE_TOKEN }} | ||
| - name: Build Docker Image for Scanning (without secrets) | ||
| if: secrets.MANAGE_TOKEN == '' | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| file: ${{ matrix.app.working_dir }}/Dockerfile | ||
| platforms: linux/amd64 | ||
| load: true | ||
| push: false | ||
| tags: ${{ env.DOCKERHUB_ORG }}/${{ matrix.app.name }}:pr-scan-${{ github.sha }} | ||
| - name: Trivy Vulnerability Scan - Docker Image (Table Output) | ||
| if: always() | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| with: | ||
| image-ref: '${{ env.DOCKERHUB_ORG }}/${{ matrix.app.name }}:pr-scan-${{ github.sha }}' | ||
| format: table | ||
| ignore-unfixed: true | ||
| vuln-type: os,library | ||
| severity: CRITICAL,HIGH | ||
| exit-code: '1' # Fail if critical/high vulnerabilities found | ||
| - name: Trivy Vulnerability Scan - Docker Image (SARIF Output) | ||
| if: always() | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| with: | ||
| image-ref: '${{ env.DOCKERHUB_ORG }}/${{ matrix.app.name }}:pr-scan-${{ github.sha }}' | ||
| format: sarif | ||
| output: 'trivy-vulnerability-scan-docker-${{ matrix.app.name }}.sarif' | ||
| ignore-unfixed: true | ||
| vuln-type: os,library | ||
| severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL | ||
| exit-code: '0' # Do not fail; gate failures in the table step | ||
| - name: ls -lah to check sarif outputs | ||
| if: always() | ||
| run: ls -lah | ||
| - name: Upload Secret Scan Results - Repository (SARIF) to GitHub Security Tab | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| if: always() && hashFiles('trivy-secret-scan-repo-${{ matrix.app.name }}.sarif') != '' | ||
| with: | ||
| sarif_file: 'trivy-secret-scan-repo-${{ matrix.app.name }}.sarif' | ||
| - name: Upload Vulnerability Scan Results - Docker Image (SARIF) to GitHub Security Tab | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| if: always() && hashFiles('trivy-vulnerability-scan-docker-${{ matrix.app.name }}.sarif') != '' | ||
| with: | ||
| sarif_file: 'trivy-vulnerability-scan-docker-${{ matrix.app.name }}.sarif' | ||
