hashicorp-tsccr[bot]andhashicorp-tsccr[bot]
e8207d4bb2
Co-authored-by: hashicorp-tsccr[bot] <hashicorp-tsccr[bot]@users.noreply.github.com>
83 lines
2.6 KiB
YAML
83 lines
2.6 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches:
|
|
- 'main'
|
|
paths-ignore:
|
|
- 'website/**'
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: ${{ fromJSON(vars.RUNNER_LARGE) }}
|
|
if: ${{ github.actor != 'dependabot[bot]' || github.actor != 'hc-github-team-secure-boundary' }}
|
|
steps:
|
|
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
|
|
- name: Determine Go version
|
|
id: get-go-version
|
|
# We use .go-version as our source of truth for current Go
|
|
# version, because "goenv" can react to it automatically.
|
|
run: |
|
|
echo "Building with Go $(cat .go-version)"
|
|
echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
|
|
with:
|
|
go-version: "${{ steps.get-go-version.outputs.go-version }}"
|
|
cache: false
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
|
|
with:
|
|
python-version: 3.x
|
|
|
|
- name: Clone Security Scanner repo
|
|
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
with:
|
|
repository: hashicorp/security-scanner
|
|
token: ${{ secrets.HASHIBOT_PRODSEC_GITHUB_TOKEN }}
|
|
path: security-scanner
|
|
ref: 5a491479f4131d343afe0a4f18f6fcd36639f3fa
|
|
|
|
- name: Install dependencies
|
|
shell: bash
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
mkdir "$HOME/.bin"
|
|
cd "$GITHUB_WORKSPACE/security-scanner/pkg/sdk/examples/scan-plugin-semgrep"
|
|
go build -o scan-plugin-semgrep .
|
|
mv scan-plugin-semgrep "$HOME/.bin"
|
|
|
|
cd "$GITHUB_WORKSPACE/security-scanner/pkg/sdk/examples/scan-plugin-codeql"
|
|
go build -o scan-plugin-codeql .
|
|
mv scan-plugin-codeql "$HOME/.bin"
|
|
|
|
# Semgrep
|
|
python3 -m pip install semgrep
|
|
|
|
# CodeQL
|
|
LATEST=$(gh release list --repo https://github.com/github/codeql-action | cut -f 3 | sort --version-sort | tail -n1)
|
|
gh release download --repo https://github.com/github/codeql-action --pattern codeql-bundle-linux64.tar.gz "$LATEST"
|
|
tar xf codeql-bundle-linux64.tar.gz -C "$HOME/.bin"
|
|
|
|
# Add to PATH
|
|
echo "$HOME/.bin" >> "$GITHUB_PATH"
|
|
echo "$HOME/.bin/codeql" >> "$GITHUB_PATH"
|
|
|
|
- name: Scan
|
|
id: scan
|
|
uses: ./security-scanner
|
|
with:
|
|
repository: "$PWD"
|
|
|
|
- name: Upload SARIF file
|
|
uses: github/codeql-action/upload-sarif@85c77f1dfc42a47cc98299e8779c151d2159b120 # codeql-bundle-v2.14.0
|
|
with:
|
|
sarif_file: results.sarif
|
|
|