chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 #5531
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Security" | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| schedule: | |
| - cron: '30 12 * * 3' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.event_name != 'workflow_dispatch' }} | |
| permissions: { } | |
| jobs: | |
| gosec: | |
| name: gosec check | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| # Skip any created PR or push by dependabot to avoid permission issues | |
| if: | | |
| github.event.pull_request.user.login != 'dependabot[bot]' && | |
| (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == 'wavesplatform/gowaves') | |
| env: | |
| GO111MODULE: on | |
| steps: | |
| - name: Checkout Source | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5 | |
| with: | |
| persist-credentials: false | |
| - name: Run gosec security scanner | |
| uses: securego/gosec@6be2b51fd78feca86af91f5186b7964d76cb1256 # v2.22.10 | |
| with: | |
| # with '-no-fail' we let the report trigger content trigger a failure using the GitHub Security features. | |
| args: "-no-fail -fmt sarif -out gosec.sarif ./..." | |
| - name: Transform gosec SARIF to meet SARIF 2.1.0 schema requirements | |
| # Produces SARIF file has two incompatibilities with SARIF 2.1.0 schema all of them are in `fixes` object: | |
| # 1. Field `description` contains only `markdown` property, but `text` property is mandatory. | |
| # 2. Property `artifactChanges` must be non-empty array with valid `artifactChange` object. | |
| # To fix those issues the first part of jq query copies content of `markdown` field into `text` field | |
| # if it's not present. In the second part if the `fixes` object has null array as `artifactChanges` the empty | |
| # valid `artifactChange` object inserted. | |
| # After fix of mentioned gosec issues this step can be removed. | |
| run: | | |
| set -e | |
| jq 'walk(if type=="object" and has("markdown") and (.text == null or .text == "") then .text = .markdown else . end) | (.runs[].results[]? .fixes[]? .artifactChanges) |= (if . == null then [{"artifactLocation": { "uri": "" }, "replacements": [{"deletedRegion": {"byteOffset": 0, "byteLength": 0 }}]}] else . end)' gosec.sarif > gosec_fixed.sarif | |
| jq empty gosec_fixed.sarif | |
| mv gosec_fixed.sarif gosec.sarif | |
| - name: Upload SARIF file for GitHub Advanced Security Dashboard | |
| uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3 | |
| with: | |
| sarif_file: gosec.sarif | |
| semgrep: | |
| name: semgrep scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| # Skip any created PR or push by dependabot to avoid permission issues and skip this check for PRs from forks | |
| if: | | |
| github.event.pull_request.user.login != 'dependabot[bot]' && | |
| (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == 'wavesplatform/gowaves') | |
| container: | |
| image: docker://semgrep/semgrep@sha256:ab68a1c0fe35f41be66e2392903aeea64b6228c16456c8c7058275bbab4c297d | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5 | |
| with: | |
| persist-credentials: false | |
| # we let the report trigger content trigger a failure using the GitHub Security features. | |
| # see https://semgrep.dev/docs/cli-usage/#exit-codes for more details. | |
| - name: Run semgrep security scanner | |
| run: | | |
| cat << 'EOF' | bash | |
| semgrep ci --config="auto" --config="r/default" --config="r/go" --config="r/dgryski" \ | |
| --config="r/trailofbits" --config="r/dockerfile" --config="r/bash" \ | |
| --config="r/problem-based-packs" --config="r/generic" --config="r/yaml" --config="r/json" \ | |
| --config="./.semgrep/rules" --sarif --dataflow-traces --output=semgrep.sarif --max-target-bytes=2MB | |
| EXIT_CODE=$? | |
| if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ] | |
| then | |
| exit 0 | |
| else | |
| exit $EXIT_CODE | |
| fi | |
| EOF | |
| - name: Upload SARIF file for GitHub Advanced Security Dashboard | |
| uses: github/codeql-action/upload-sarif@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3 | |
| with: | |
| sarif_file: semgrep.sarif | |
| vuln-scan: | |
| name: Vulnerability scanner | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v5 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 | |
| with: | |
| go-version: 1.24.x | |
| check-latest: true | |
| cache: true | |
| - name: Run go list | |
| run: go list -json -deps ./... > go.list | |
| - name: Nancy | |
| if: (github.repository == 'wavesplatform/gowaves' && github.event.pull_request.head.repo.fork != true) | |
| uses: sonatype-nexus-community/nancy-github-action@726e338312e68ecdd4b4195765f174d3b3ce1533 # v1.0.3 | |
| with: | |
| nancyVersion: latest | |
| goListFile: go.list | |
| nancyCommand: sleuth --username ${{ vars.OSSINDEX_USER }} --token ${{ secrets.OSSINDEX_TOKEN }} | |
| - name: govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./... |