-
Notifications
You must be signed in to change notification settings - Fork 12
103 lines (95 loc) · 3.67 KB
/
sast.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
---
name: "sast"
on:
pull_request:
branches:
- "main"
push:
branches:
- "main"
schedule:
- cron: "19 19 * * 4"
permissions: "read-all"
jobs:
ossf:
runs-on: "ubuntu-latest"
# ossf scorecard only supported on main branch
if: github.event_name != 'pull_request'
permissions:
security-events: "write"
id-token: "write"
contents: "read"
actions: "read"
steps:
- uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11"
with:
persist-credentials: false
- uses: "ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736"
with:
results_file: "results.sarif"
results_format: "sarif"
publish_results: true
- uses: "actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32"
with:
name: "SARIF file"
path: "results.sarif"
retention-days: 5
- uses: "github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75"
with:
sarif_file: "results.sarif"
osv:
permissions:
contents: "read"
runs-on: "ubuntu-latest"
steps:
- uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11"
- uses: "actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe"
with:
go-version: "stable"
- run: |
curl -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v1.4.3/osv-scanner_1.4.3_linux_amd64 \
&& chmod +x /usr/local/bin/osv-scanner \
&& /usr/local/bin/osv-scanner -version
- run: "make sast_osv"
snyk:
permissions:
contents: "read"
security-events: "write"
runs-on: "ubuntu-latest"
steps:
- uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11"
- uses: "pnpm/action-setup@d882d12c64e032187b2edb46d3a0d003b7a43598"
with:
version: "latest"
- uses: "actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65"
with:
node-version-file: ".nvmrc"
cache: "pnpm"
- uses: "snyk/actions/setup@b98d498629f1c368650224d6d212bf7dfa89e4bf"
- run: "make install"
- run: "snyk test --all-projects --detection-depth=1 --sarif-file-output=snyk.sarif"
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
- uses: "github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75"
with:
sarif_file: "snyk.sarif"
codeql:
runs-on: "ubuntu-latest"
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11"
- uses: "github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75"
with:
languages: "typescript"
- uses: "pnpm/action-setup@d882d12c64e032187b2edb46d3a0d003b7a43598"
with:
version: "latest"
- uses: "actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65"
with:
node-version-file: ".nvmrc"
cache: "pnpm"
- run: "make install"
- uses: "github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75"