Skip to content

Commit 03ab92c

Browse files
rcambrjrcambrj
committed
implement basic automatic security audit
1 parent 07d7ddf commit 03ab92c

File tree

4 files changed

+162
-26
lines changed

4 files changed

+162
-26
lines changed

‎.github/workflows/build-and-release.yaml‎

Lines changed: 159 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,66 @@ on:
2222
permissions:
2323
contents: write
2424
packages: write
25+
security-events: write
2526

2627
jobs:
28+
scan-codeql:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: Check out code
32+
uses: actions/checkout@v5
33+
34+
- uses: actions/dependency-review-action@v4
35+
36+
- uses: github/codeql-action/init@v3
37+
with:
38+
languages: actions,go
39+
- uses: github/codeql-action/analyze@v3
40+
41+
scan-go:
42+
runs-on: ubuntu-latest
43+
steps:
44+
- name: Check out code
45+
uses: actions/checkout@v5
46+
47+
- name: Install Go
48+
uses: actions/setup-go@v5
49+
with:
50+
go-version-file: go.mod
51+
52+
- name: Check Go dependencies
53+
uses: golang/govulncheck-action@v1
54+
with:
55+
go-package: ./...
56+
output-format: sarif
57+
output-file: govulncheck.sarif
58+
- name: Upload SARIF file
59+
uses: github/codeql-action/upload-sarif@v3
60+
with:
61+
sarif_file: govulncheck.sarif
62+
63+
- name: Check Go source code
64+
uses: securego/gosec@master
65+
with:
66+
args: '-no-fail -fmt sarif -out gosec.sarif ./...'
67+
- name: Upload SARIF file
68+
uses: github/codeql-action/upload-sarif@v3
69+
with:
70+
sarif_file: gosec.sarif
71+
72+
scan-nix:
73+
runs-on: ubuntu-latest
74+
steps:
75+
- name: Check out code
76+
uses: actions/checkout@v5
77+
78+
- name: Check Nix flake inputs
79+
uses: DeterminateSystems/flake-checker-action@main
80+
with:
81+
send-statistics: false
82+
2783
build-go:
84+
needs: [ scan-codeql, scan-go, scan-nix ]
2885
runs-on: ubuntu-latest
2986
strategy:
3087
matrix:
@@ -68,8 +125,10 @@ jobs:
68125
with:
69126
name: multigres-operator-${{matrix.arch}}
70127
path: dist/*
128+
if-no-files-found: error
129+
retention-days: 7
71130

72-
build-push-container:
131+
build-scan-push-container:
73132
needs: [ build-go ]
74133
runs-on: ubuntu-latest
75134
steps:
@@ -79,49 +138,123 @@ jobs:
79138
- name: Set up QEMU
80139
uses: docker/setup-qemu-action@v3
81140

82-
- name: Setup Docker buildx
83-
uses: docker/setup-buildx-action@v3
84-
85-
- name: Log into registry
86-
uses: docker/login-action@v3
141+
- name: Set up Docker for multi-platform
142+
uses: docker/setup-docker-action@v4
87143
with:
88-
registry: ghcr.io
89-
username: ${{ github.actor }}
90-
password: ${{ secrets.GITHUB_TOKEN }}
144+
daemon-config: |
145+
{
146+
"debug": true,
147+
"features": {
148+
"containerd-snapshotter": true
149+
}
150+
}
91151
92-
- name: Extract container metadata
93-
id: meta
94-
uses: docker/metadata-action@v5
95-
with:
96-
github-token: ${{ secrets.GITHUB_TOKEN }}
97-
images: ghcr.io/${{ github.repository }}
98-
tags: |
99-
type=ref,event=branch,prefix=
100-
type=ref,event=tag,prefix=
101-
type=sha,format=short,prefix=
102-
type=sha,format=long,prefix=
152+
- name: Setup Docker buildx
153+
uses: docker/setup-buildx-action@v3
103154

104155
- uses: actions/download-artifact@v5
105156
with:
106157
pattern: multigres-operator-*
107158
path: dist/
108159

109-
- name: Build and push container image
110-
id: build-and-push
160+
- name: Build container image
111161
uses: docker/build-push-action@v5
112162
with:
113163
context: .
114164
file: Containerfile
115165
platforms: linux/${{ join(fromJson(inputs.architectures), ',linux/') }}
116-
push: ${{ inputs.push-container-image }}
117-
tags: ${{ steps.meta.outputs.tags }}
118-
labels: ${{ steps.meta.outputs.labels }}
166+
push: false
167+
tags: "ghcr.io/${{ github.repository }}:${{ github.sha }}"
119168
provenance: false
120169
cache-from: type=gha
121170
cache-to: type=gha,mode=max
171+
outputs: type=oci,dest=container-image.tar
172+
173+
- name: Scan image with grype
174+
id: scan
175+
# requires that the container image be built already
176+
# keep simple by running this in the same job as build
177+
uses: anchore/scan-action@v6
178+
with:
179+
image: "ghcr.io/${{ github.repository }}:${{ github.sha }}"
180+
- name: Upload SARIF file
181+
uses: github/codeql-action/upload-sarif@v3
182+
with:
183+
sarif_file: ${{ steps.scan.outputs.sarif }}
184+
185+
- name: Log into registry
186+
uses: docker/login-action@v3
187+
with:
188+
registry: ghcr.io
189+
username: ${{ github.actor }}
190+
password: ${{ secrets.GITHUB_TOKEN }}
191+
192+
- name: Push to registry
193+
if: ${{ inputs.push-container-image }}
194+
run: |
195+
IMAGE="ghcr.io/${{ github.repository }}"
196+
docker load --input container-image.tar
197+
docker push "$IMAGE:${{ github.sha }}"
198+
if [ "${{ github.ref }}" = "refs/heads/main" ]; then
199+
docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:latest"
200+
docker push "$IMAGE:latest"
201+
fi
202+
if [ "${{ github.ref_type }}" = "tag" ]; then
203+
docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:${{ github.ref_name }}"
204+
docker push "$IMAGE:${{ github.ref_name }}"
205+
fi
206+
# - name: Upload image artifact
207+
# uses: actions/upload-artifact@v4
208+
# with:
209+
# name: container-image-tar
210+
# path: container-image.tar
211+
# if-no-files-found: error
212+
# retention-days: 7
213+
214+
# scan-container:
215+
# # requires that the container image be built already
216+
# needs: [ build-container ]
217+
# runs-on: ubuntu-latest
218+
# steps:
219+
# - name: Scan image with grype
220+
# uses: anchore/scan-action@v6
221+
# with:
222+
# image: "ghcr.io/${{ github.repository }}:${{ github.sha }}"
223+
224+
# push-container:
225+
# needs: [ scan-container ]
226+
# runs-on: ubuntu-latest
227+
# if: ${{ inputs.push-container-image }}
228+
# steps:
229+
# - name: Download image artifact
230+
# uses: actions/download-artifact@v4
231+
# with:
232+
# name: container-image-tar
233+
# path: .
234+
235+
# # - name: Log into registry
236+
# # uses: docker/login-action@v3
237+
# # with:
238+
# # registry: ghcr.io
239+
# # username: ${{ github.actor }}
240+
# # password: ${{ secrets.GITHUB_TOKEN }}
241+
242+
# - name: Push to registry
243+
# run: |
244+
# IMAGE="ghcr.io/${{ github.repository }}"
245+
# docker load --input container-image.tar
246+
# docker push "$IMAGE:${{ github.sha }}"
247+
# if [ "${{ github.ref }}" = "refs/heads/main" ]; then
248+
# docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:latest"
249+
# docker push "$IMAGE:latest"
250+
# fi
251+
# if [ "${{ github.ref_type }}" = "tag" ]; then
252+
# docker tag "$IMAGE:${{ github.sha }}" "$IMAGE:${{ github.ref_name }}"
253+
# docker push "$IMAGE:${{ github.ref_name }}"
254+
# fi
122255

123256
create-release:
124-
needs: [ build-go ]
257+
needs: [ build-scan-push-container ]
125258
runs-on: ubuntu-latest
126259
if: ${{ inputs.create-release }}
127260
steps:

‎.github/workflows/main.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ on:
99
permissions:
1010
contents: write
1111
packages: write
12+
security-events: write
1213

1314
jobs:
1415
run:

‎.github/workflows/pull-request.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66
permissions:
77
contents: write
88
packages: write
9+
security-events: write
910

1011
jobs:
1112
run:

‎.github/workflows/tags.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
permissions:
99
contents: write
1010
packages: write
11+
security-events: write
1112

1213
jobs:
1314
run:

0 commit comments

Comments
 (0)