feat(sec-pipeline): implement unified container scanning architecture #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: SCA CI - app | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 2 * * 1' # weekly SCA scan, every Monday 02:00 UTC | |
| jobs: | |
| sca: | |
| name: Software Composition Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # required for uploading SCA results to github security | |
| env: | |
| SBOM_PATH: target/bom.json | |
| TRIVY_IGNOREFILE: .github/scripts/suppress_trivy.yaml | |
| OSV_IGNOREFILE: .github/scripts/suppress_osv_scanner.toml | |
| TRIVY_SARIF_OUTPUT: trivy-app.sarif | |
| OSV_SARIF_OUTPUT: osv-scanner-app.sarif | |
| MERGED_SARIF_OUTPUT: merged-SCA-platform-backend-app.sarif | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 | |
| with: | |
| python-version: '3.14.4' | |
| - name: Cache Maven packages | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0 | |
| with: | |
| path: ~/.m2/repository # /.m2 only is too broad and can cause cache corruption issues | |
| key: ${{ runner.os }}-m2-v1-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: ${{ runner.os }}-m2-v1- | |
| - name: Resolve Maven dependencies | |
| run: mvn dependency:resolve -q | |
| - name: Setup tools | |
| run: bash .github/scripts/setup-tools.sh --install-tool trivy,osv-scanner --sbom-ecosystem maven | |
| - name: Run SCA tools | |
| run: python .github/scripts/run_sca_app.py | |
| - name: Upload Trivy SARIF to GitHub Security tab | |
| id: upload_trivy | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 #v2.25.6 | |
| with: | |
| sarif_file: ${{ env.TRIVY_SARIF_OUTPUT }} | |
| category: trivy-app | |
| - name: Upload OSV Scanner SARIF to GitHub Security tab | |
| id: upload_osv | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 #v2.25.6 | |
| with: | |
| sarif_file: ${{ env.OSV_SARIF_OUTPUT }} | |
| category: osv-scanner-app | |
| - name: Upload merged SARIF to GitHub Security tab | |
| if: ${{ always() && steps.upload_trivy.outcome == 'success' && steps.upload_osv.outcome == 'success' }} | |
| uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 #v2.25.6 | |
| with: | |
| sarif_file: ${{ env.MERGED_SARIF_OUTPUT }} | |
| category: merged-sca-app |