77 lines
1.7 KiB
YAML
77 lines
1.7 KiB
YAML
name: Security Checks
|
|
|
|
on:
|
|
workflow_call:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
nextjs-security:
|
|
name: nextjs-security
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: yarn
|
|
cache-dependency-path: ui/dashboard/yarn.lock
|
|
|
|
- name: Install dependencies
|
|
working-directory: ui/dashboard
|
|
run: yarn install --frozen-lockfile
|
|
|
|
- name: Run ESLint
|
|
working-directory: ui/dashboard
|
|
run: yarn lint
|
|
|
|
- name: Run npm audit (production)
|
|
working-directory: ui/dashboard
|
|
run: npm audit --production
|
|
continue-on-error: true
|
|
|
|
- name: Run Semgrep security rules
|
|
uses: returntocorp/semgrep-action@v1
|
|
with:
|
|
config: p/ci
|
|
paths: ui/dashboard
|
|
|
|
go-security:
|
|
name: go-security
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v4
|
|
with:
|
|
go-version: "1.22"
|
|
|
|
- name: Run golangci-lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
with:
|
|
version: latest
|
|
args: ./...
|
|
|
|
- name: Install gosec
|
|
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
|
|
|
|
- name: Run gosec
|
|
run: gosec ./...
|
|
|
|
- name: Run Trivy filesystem scan
|
|
uses: aquasecurity/trivy-action@0.24.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: true
|
|
format: table
|
|
exit-code: "0"
|