Security #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| # Run weekly on Monday at 06:00 UTC | |
| - cron: "0 6 * * 1" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| env: | |
| GO_VERSION: "1.26" | |
| jobs: | |
| govulncheck: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck | |
| run: | | |
| # Run govulncheck; capture output and exit code | |
| set +e | |
| OUTPUT=$(govulncheck ./... 2>&1) | |
| EXIT_CODE=$? | |
| echo "$OUTPUT" | |
| set -e | |
| if [ $EXIT_CODE -eq 0 ]; then | |
| echo "No vulnerabilities found." | |
| exit 0 | |
| fi | |
| # Check if all vulns are stdlib-only (fixable only by upgrading Go) | |
| THIRD_PARTY=$(echo "$OUTPUT" | grep -A1 "^Vulnerability" | grep "Module:" || true) | |
| if [ -z "$THIRD_PARTY" ]; then | |
| echo "" | |
| echo "::warning::Only Go stdlib vulnerabilities found — upgrade Go to fix." | |
| exit 0 | |
| fi | |
| echo "" | |
| echo "::error::Third-party dependency vulnerabilities found." | |
| exit 1 | |
| trivy: | |
| name: Container Image Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| # Need history to diff against the PR base for change detection. | |
| fetch-depth: 0 | |
| - name: Detect image-relevant changes | |
| id: changes | |
| run: | | |
| # Always scan on push (main/develop) and on schedule. Only PRs | |
| # get the change-detection short-circuit, since a PR that doesn't | |
| # touch any image input cannot change what trivy would report. | |
| if [ "${{ github.event_name }}" != 'pull_request' ]; then | |
| echo "should_scan=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| CHANGED=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD") | |
| if echo "$CHANGED" | grep -Eq '^(build/Dockerfile|go\.mod|go\.sum|\.github/workflows/security\.yml)$|^(internal|api|cmd)/'; then | |
| echo "should_scan=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "should_scan=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::No image inputs changed; skipping container scan." | |
| fi | |
| - name: Build image | |
| if: steps.changes.outputs.should_scan == 'true' | |
| run: docker build -t authserver:scan -f build/Dockerfile . | |
| - uses: aquasecurity/trivy-action@master | |
| if: steps.changes.outputs.should_scan == 'true' | |
| with: | |
| image-ref: authserver:scan | |
| format: table | |
| severity: CRITICAL,HIGH | |
| exit-code: "1" |