From bf4f270bd11c72c851b0cd8959a5278434f5cfeb Mon Sep 17 00:00:00 2001 From: manhtukhang Date: Wed, 4 Dec 2024 13:27:48 +0700 Subject: [PATCH 1/2] chore: added Scorecard and Dependency Review workflows Signed-off-by: manhtukhang --- .github/workflows/dependency-review.yaml | 14 ++++++ .github/workflows/scorecard.yaml | 57 ++++++++++++++++++++++++ 2 files changed, 71 insertions(+) create mode 100644 .github/workflows/dependency-review.yaml create mode 100644 .github/workflows/scorecard.yaml diff --git a/.github/workflows/dependency-review.yaml b/.github/workflows/dependency-review.yaml new file mode 100644 index 0000000..f01d356 --- /dev/null +++ b/.github/workflows/dependency-review.yaml @@ -0,0 +1,14 @@ +name: 'Dependency Review' +on: [ pull_request ] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: 'Checkout Repository' + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - name: 'Dependency Review' + uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0 diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml new file mode 100644 index 0000000..c53862e --- /dev/null +++ b/.github/workflows/scorecard.yaml @@ -0,0 +1,57 @@ +name: Scorecard analysis +on: + branch_protection_rule: + push: + # Only the default branch is supported. + branches: + - main + schedule: + # Weekly on Saturdays. + - cron: '30 1 * * 6' + +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed for Code scanning upload + security-events: write + # Needed for GitHub OIDC token if publish_results is true + id-token: write + + steps: + - name: Checkout code + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: Run analysis + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 + with: + results_file: results.sarif + results_format: sarif + # Scorecard team runs a weekly scan of public GitHub repos, + # see https://github.com/ossf/scorecard#public-data. + # Setting `publish_results: true` helps us scale by leveraging your workflow to + # extract the results instead of relying on our own infrastructure to run scans. + # And it's free for you! + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable + # uploads of run results in SARIF format to the repository Actions tab. + # https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts + - name: Upload artifact + uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard + - name: Upload to code-scanning + uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5 + with: + sarif_file: results.sarif From 14faa96a746adcbe8d2e43ae190525172ebdb22f Mon Sep 17 00:00:00 2001 From: manhtukhang Date: Wed, 4 Dec 2024 13:56:47 +0700 Subject: [PATCH 2/2] chore: added CodeQL workflow Signed-off-by: manhtukhang --- .github/workflows/codeql.yaml | 62 +++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 .github/workflows/codeql.yaml diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml new file mode 100644 index 0000000..925e654 --- /dev/null +++ b/.github/workflows/codeql.yaml @@ -0,0 +1,62 @@ +name: CodeQL + +on: + push: + branches: [ main ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ main ] + schedule: + - cron: '36 19 * * 3' + +permissions: + contents: read + +jobs: + pre_job: + # continue-on-error: true + runs-on: ubuntu-latest + outputs: + should_skip: ${{ steps.skip_check.outputs.should_skip }} + steps: + - id: skip_check + uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1 + with: + concurrent_skipping: 'same_content_newer' + skip_after_successful_duplicate: 'true' + cancel_others: 'true' + do_not_skip: '["pull_request", "workflow_dispatch", "schedule"]' + paths: '["go.mod", "go.sum", "Makefile", "src/**/*"]' + + analyze: + permissions: + actions: read # for github/codeql-action/init to get workflow details + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/autobuild to send a status report + name: Analyze + runs-on: ubuntu-latest + if: needs.pre_job.outputs.should_skip != 'true' + strategy: + fail-fast: false + matrix: + language: [ go ] + steps: + - name: Harden Runner + uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Initialize CodeQL + uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5 + with: + languages: ${{ matrix.language }} + queries: +security-extended + + - name: Autobuild + uses: github/codeql-action/autobuild@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5