Create separate Docker images for each service. #756
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Security" | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| - cron: '30 12 * * 3' | |
| jobs: | |
| gosec: | |
| name: gosec check | |
| runs-on: ubuntu-latest | |
| # Skip any created PR or push by dependabot to avoid permission issues | |
| if: github.actor != 'dependabot[bot]' | |
| env: | |
| GO111MODULE: on | |
| steps: | |
| - name: Checkout Source | |
| uses: actions/checkout@v4 | |
| - name: Run gosec security scanner | |
| uses: securego/gosec@v2.17.0 | |
| with: | |
| # with '-no-fail' we let the report trigger content trigger a failure using the GitHub Security features. | |
| args: "-no-fail -fmt sarif -out gosec.sarif ./..." | |
| - name: Upload SARIF file for GitHub Advanced Security Dashboard | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: gosec.sarif | |
| semgrep: | |
| name: semgrep scan | |
| runs-on: ubuntu-latest | |
| # Skip any created PR or push by dependabot to avoid permission issues | |
| if: github.actor != 'dependabot[bot]' | |
| container: | |
| image: returntocorp/semgrep:latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # we let the report trigger content trigger a failure using the GitHub Security features. | |
| # see https://semgrep.dev/docs/cli-usage/#exit-codes for more details. | |
| - name: Run semgrep security scanner | |
| run: | | |
| cat << 'EOF' | bash | |
| semgrep ci --config=auto --sarif --output=semgrep.sarif --max-target-bytes=2MB | |
| EXIT_CODE=$? | |
| if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ] | |
| then | |
| exit 0 | |
| else | |
| exit $EXIT_CODE | |
| fi | |
| EOF | |
| - name: Upload SARIF file for GitHub Advanced Security Dashboard | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: semgrep.sarif | |
| vuln-scan: | |
| name: Vulnerability scanner | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v4.1.0 | |
| with: | |
| go-version: 1.20.x | |
| check-latest: true | |
| cache: true | |
| - name: Run go list | |
| run: go list -json -deps ./... > go.list | |
| - name: Nancy | |
| uses: sonatype-nexus-community/nancy-github-action@v1.0.3 | |
| - name: govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./... |