generated from bcgov/quickstart-openshift
-
Notifications
You must be signed in to change notification settings - Fork 1
91 lines (80 loc) · 2.66 KB
/
analysis.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: Analysis
on:
push:
branches: [main]
pull_request:
types: [opened, reopened, synchronize, ready_for_review]
schedule:
- cron: "0 12 * * 0" # 4 AM PST = 12 PM UDT, runs sundays
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
CodeQL:
name: CodeQL
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-22.04
strategy:
matrix:
language: [go, java, javascript, python]
include:
- language: go
working-directory: backend-go
build: |
sed -i '/^toolchain .*$/d' go.mod
go install github.com/swaggo/swag/cmd/swag@latest
CGO_ENABLED=0 GOOS=linux go build -v
- language: "java"
working-directory: backend-java
build: ./mvnw package -DskipTests
- language: "javascript"
- language: "python"
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
- name: Autobuild
if: ${{ ! matrix.build }}
uses: github/codeql-action/autobuild@v2
- uses: actions/setup-java@v3
if: ${{ matrix.build && matrix.language == 'java' }}
with:
distribution: "temurin"
java-version: "17"
- uses: actions/cache@v3
if: ${{ matrix.build && matrix.language == 'java' }}
with:
path: ~/.m2/repository
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
restore-keys: |
${{ runner.os }}-maven-
- name: Build
if: ${{ matrix.build }}
run: ${{ matrix.build }}
working-directory: ${{ matrix.working-directory }}
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
with:
category: "/language:${{matrix.language}}"
# https://github.com/marketplace/actions/aqua-security-trivy
trivy:
name: Trivy Security Scan
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@0.12.0
with:
format: "sarif"
output: "trivy-results.sarif"
ignore-unfixed: true
scan-type: "fs"
scanners: "vuln,secret,config"
severity: "CRITICAL,HIGH"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: "trivy-results.sarif"