Skip to content

Commit fcd0421

Browse files
h4x3rotabh4x3rotab
committed
update workflow
1 parent ce88b5a commit fcd0421

File tree

2 files changed

+81
-146
lines changed

2 files changed

+81
-146
lines changed

‎.github/workflows/security-scan.yml‎

Lines changed: 46 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,24 @@ on:
1010
- cron: '0 2 * * 1'
1111

1212
jobs:
13+
basic-security-checks:
14+
runs-on: ubuntu-latest
15+
name: Basic Security Checks
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Install dependencies
20+
run: |
21+
# Install shellcheck
22+
sudo apt-get update
23+
sudo apt-get install -y shellcheck
24+
25+
# Install yamllint
26+
pip install yamllint
27+
28+
- name: Run dev.sh security checks
29+
run: ./dev.sh security
30+
1331
secret-scan:
1432
runs-on: ubuntu-latest
1533
name: Secret Detection
@@ -80,53 +98,13 @@ jobs:
8098
with:
8199
sarif_file: hadolint-results.sarif
82100

83-
compose-security:
84-
runs-on: ubuntu-latest
85-
name: Docker Compose Security Check
86-
steps:
87-
- uses: actions/checkout@v4
88-
89-
- name: Security check for Docker Compose files
90-
run: |
91-
echo "Checking Docker Compose files for security issues..."
92-
93-
# Find all docker-compose files
94-
find . -name "docker-compose.y*ml" | while read -r compose_file; do
95-
echo "Checking: $compose_file"
96-
97-
# Check for privileged containers
98-
if grep -q "privileged.*true" "$compose_file"; then
99-
echo "❌ Privileged container found in: $compose_file"
100-
fi
101-
102-
# Check for host network mode
103-
if grep -q "network_mode.*host" "$compose_file"; then
104-
echo "⚠️ Host network mode found in: $compose_file"
105-
fi
106-
107-
# Check for dangerous volume mounts
108-
if grep -q "/var/run/docker.sock" "$compose_file"; then
109-
echo "❌ Docker socket mount found in: $compose_file"
110-
fi
111-
112-
if grep -q ":/proc" "$compose_file"; then
113-
echo "⚠️ /proc mount found in: $compose_file"
114-
fi
115-
116-
# Check for exposed sensitive ports
117-
if grep -E "ports:.*:(22|3306|5432|6379|27017|9200)" "$compose_file"; then
118-
echo "⚠️ Sensitive ports exposed in: $compose_file"
119-
fi
120-
121-
# Check for missing restart policies
122-
if ! grep -q "restart:" "$compose_file"; then
123-
echo "ℹ️ No restart policy specified in: $compose_file"
124-
fi
125-
done
126-
127101
code-security:
128102
runs-on: ubuntu-latest
129103
name: Code Security Analysis
104+
permissions:
105+
actions: read
106+
contents: read
107+
security-events: write
130108
steps:
131109
- uses: actions/checkout@v4
132110

@@ -144,9 +122,28 @@ jobs:
144122
with:
145123
category: "/language:javascript,python,go"
146124

125+
comprehensive-security:
126+
runs-on: ubuntu-latest
127+
if: github.event_name == 'schedule'
128+
name: Comprehensive Security Check
129+
steps:
130+
- uses: actions/checkout@v4
131+
132+
- name: Install dependencies
133+
run: |
134+
# Install shellcheck
135+
sudo apt-get update
136+
sudo apt-get install -y shellcheck
137+
138+
# Install yamllint
139+
pip install yamllint
140+
141+
- name: Run all checks
142+
run: ./dev.sh check-all
143+
147144
security-summary:
148145
runs-on: ubuntu-latest
149-
needs: [secret-scan, dependency-scan, dockerfile-scan, compose-security, code-security]
146+
needs: [basic-security-checks, secret-scan, dependency-scan, dockerfile-scan, code-security]
150147
if: always()
151148
name: Security Summary
152149

@@ -157,24 +154,24 @@ jobs:
157154
echo "" >> $GITHUB_STEP_SUMMARY
158155
159156
# Check job results
157+
basic_result="${{ needs.basic-security-checks.result }}"
160158
secret_result="${{ needs.secret-scan.result }}"
161159
dependency_result="${{ needs.dependency-scan.result }}"
162160
dockerfile_result="${{ needs.dockerfile-scan.result }}"
163-
compose_result="${{ needs.compose-security.result }}"
164161
code_result="${{ needs.code-security.result }}"
165162
166163
echo "| Security Check | Status |" >> $GITHUB_STEP_SUMMARY
167164
echo "|----------------|--------|" >> $GITHUB_STEP_SUMMARY
165+
echo "| Basic Security | $basic_result |" >> $GITHUB_STEP_SUMMARY
168166
echo "| Secret Detection | $secret_result |" >> $GITHUB_STEP_SUMMARY
169167
echo "| Dependency Scan | $dependency_result |" >> $GITHUB_STEP_SUMMARY
170168
echo "| Dockerfile Scan | $dockerfile_result |" >> $GITHUB_STEP_SUMMARY
171-
echo "| Compose Security | $compose_result |" >> $GITHUB_STEP_SUMMARY
172169
echo "| Code Analysis | $code_result |" >> $GITHUB_STEP_SUMMARY
173170
echo "" >> $GITHUB_STEP_SUMMARY
174171
175172
# Overall status
176-
if [[ "$secret_result $dependency_result $dockerfile_result $compose_result $code_result" == *"failure"* ]]; then
173+
if [[ "$basic_result $secret_result $dependency_result $dockerfile_result $code_result" == *"failure"* ]]; then
177174
echo "🔴 **Security issues detected!** Please review the scan results." >> $GITHUB_STEP_SUMMARY
178175
else
179176
echo "🟢 **All security scans passed successfully.**" >> $GITHUB_STEP_SUMMARY
180-
fi
177+
fi

‎.github/workflows/validate-examples.yml‎

Lines changed: 35 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@ jobs:
2424
run: |
2525
if [ "${{ github.event_name }}" == "schedule" ]; then
2626
# For scheduled runs, test all examples
27-
examples=$(find . -name "docker-compose.y*ml" -not -path "./.github/*" | xargs dirname | sort -u | jq -R -s -c 'split("\n")[:-1]')
27+
examples=$(./dev.sh list | grep -E "^ - " | sed 's/^ - //' | jq -R -s -c 'split("\n")[:-1]')
2828
else
2929
# For PR/push, only test changed examples
3030
changed_files=$(git diff --name-only ${{ github.event.before }}..${{ github.sha }} || git diff --name-only HEAD~1)
31-
examples=$(echo "$changed_files" | grep -E "(docker-compose\.ya?ml|Dockerfile|\.sh)$" | xargs dirname | sort -u | jq -R -s -c 'split("\n")[:-1]' || echo '[]')
31+
examples=$(echo "$changed_files" | grep -E "(docker-compose\.ya?ml|Dockerfile|\.sh)$" | xargs dirname 2>/dev/null | sort -u | jq -R -s -c 'split("\n")[:-1]' || echo '[]')
3232
fi
3333
echo "examples=$examples" >> $GITHUB_OUTPUT
3434
35-
validate-structure:
35+
validate-examples:
3636
runs-on: ubuntu-latest
3737
needs: detect-changes
3838
if: needs.detect-changes.outputs.examples != '[]'
@@ -44,113 +44,53 @@ jobs:
4444
steps:
4545
- uses: actions/checkout@v4
4646

47-
- name: Validate example structure
47+
- name: Validate example
4848
run: |
4949
example="${{ matrix.example }}"
50-
echo "Validating structure for: $example"
50+
echo "Validating: $example"
51+
./dev.sh validate "$example"
5152
52-
# Check if directory exists
53-
if [ ! -d "$example" ]; then
54-
echo "❌ Example directory does not exist: $example"
55-
exit 1
56-
fi
57-
58-
# Check for required files
59-
required_files=("README.md")
60-
for file in "${required_files[@]}"; do
61-
if [ ! -f "$example/$file" ]; then
62-
echo "❌ Missing required file: $example/$file"
63-
exit 1
64-
fi
65-
done
66-
67-
# Check for docker-compose file
68-
if [ ! -f "$example/docker-compose.yml" ] && [ ! -f "$example/docker-compose.yaml" ]; then
69-
echo "❌ Missing docker-compose file in: $example"
70-
exit 1
71-
fi
72-
73-
echo "✅ Structure validation passed for: $example"
74-
75-
validate-docker-compose:
53+
lint-and-security:
7654
runs-on: ubuntu-latest
77-
needs: detect-changes
78-
if: needs.detect-changes.outputs.examples != '[]'
79-
strategy:
80-
matrix:
81-
example: ${{ fromJson(needs.detect-changes.outputs.examples) }}
82-
fail-fast: false
83-
8455
steps:
8556
- uses: actions/checkout@v4
8657

87-
- name: Validate Docker Compose files
58+
- name: Install dependencies
8859
run: |
89-
example="${{ matrix.example }}"
90-
echo "Validating Docker Compose for: $example"
91-
92-
cd "$example"
93-
94-
# Find docker-compose file
95-
compose_file=""
96-
if [ -f "docker-compose.yml" ]; then
97-
compose_file="docker-compose.yml"
98-
elif [ -f "docker-compose.yaml" ]; then
99-
compose_file="docker-compose.yaml"
100-
else
101-
echo "❌ No docker-compose file found in: $example"
102-
exit 1
103-
fi
60+
# Install shellcheck
61+
sudo apt-get update
62+
sudo apt-get install -y shellcheck
63+
64+
# Install yamllint
65+
pip install yamllint
10466
105-
# Validate compose file syntax
106-
if ! docker compose -f "$compose_file" config > /dev/null; then
107-
echo "❌ Invalid docker-compose syntax in: $example/$compose_file"
108-
exit 1
109-
fi
67+
- name: Run lint checks
68+
run: ./dev.sh lint
11069

111-
echo "✅ Docker Compose validation passed for: $example"
70+
- name: Run security checks
71+
run: ./dev.sh security
11272

113-
security-scan:
73+
comprehensive-check:
11474
runs-on: ubuntu-latest
115-
needs: detect-changes
116-
if: needs.detect-changes.outputs.examples != '[]'
117-
strategy:
118-
matrix:
119-
example: ${{ fromJson(needs.detect-changes.outputs.examples) }}
120-
fail-fast: false
121-
75+
if: github.event_name == 'schedule'
12276
steps:
12377
- uses: actions/checkout@v4
12478

125-
- name: Security scan
79+
- name: Install dependencies
12680
run: |
127-
example="${{ matrix.example }}"
128-
echo "Running security scan for: $example"
81+
# Install shellcheck
82+
sudo apt-get update
83+
sudo apt-get install -y shellcheck
84+
85+
# Install yamllint
86+
pip install yamllint
12987
130-
# Check for common security issues
131-
security_issues=0
132-
133-
# Check for hardcoded secrets (basic patterns)
134-
if grep -r -i -E "(password|secret|key|token).*=.*['\"][^'\"]{8,}['\"]" "$example/" 2>/dev/null; then
135-
echo "⚠️ Potential hardcoded secrets found in: $example"
136-
security_issues=$((security_issues + 1))
137-
fi
138-
139-
# Check for exposed sensitive ports
140-
if grep -E "ports:.*:(22|3306|5432|6379|27017)" "$example"/*.yml "$example"/*.yaml 2>/dev/null; then
141-
echo "⚠️ Potentially sensitive ports exposed in: $example"
142-
security_issues=$((security_issues + 1))
143-
fi
144-
145-
if [ $security_issues -gt 0 ]; then
146-
echo "⚠️ Security scan completed with $security_issues potential issues in: $example"
147-
else
148-
echo "✅ Security scan passed for: $example"
149-
fi
88+
- name: Run all checks
89+
run: ./dev.sh check-all
15090

15191
summary:
15292
runs-on: ubuntu-latest
153-
needs: [detect-changes, validate-structure, validate-docker-compose, security-scan]
93+
needs: [detect-changes, validate-examples, lint-and-security]
15494
if: always()
15595

15696
steps:
@@ -167,13 +107,11 @@ jobs:
167107
echo "" >> $GITHUB_STEP_SUMMARY
168108
169109
# Check job results
170-
structure_result="${{ needs.validate-structure.result }}"
171-
compose_result="${{ needs.validate-docker-compose.result }}"
172-
security_result="${{ needs.security-scan.result }}"
110+
validation_result="${{ needs.validate-examples.result }}"
111+
lint_security_result="${{ needs.lint-and-security.result }}"
173112
174113
echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
175114
echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
176-
echo "| Structure | $structure_result |" >> $GITHUB_STEP_SUMMARY
177-
echo "| Docker Compose | $compose_result |" >> $GITHUB_STEP_SUMMARY
178-
echo "| Security Scan | $security_result |" >> $GITHUB_STEP_SUMMARY
179-
fi
115+
echo "| Example Validation | $validation_result |" >> $GITHUB_STEP_SUMMARY
116+
echo "| Lint & Security | $lint_security_result |" >> $GITHUB_STEP_SUMMARY
117+
fi

0 commit comments

Comments
 (0)