Renovate-Bot
68fe52ec3e
Testing Build, Publish & Preview Release / Build, Publish Packages (Testing) & Create Preview Release (push) Skipped
Unit-Tests / Unit-Tests (pull_request) Skipped
TruffleHog Secret Scan / TruffleHog (push) Successful in 26s
TruffleHog Secret Scan / TruffleHog (pull_request) Successful in 25s
Security Scans / Trivy & OSV-Scanner (pull_request) Successful in 50s
96 lines
3.0 KiB
YAML
96 lines
3.0 KiB
YAML
name: Security Scans
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- testing
|
|
- dev
|
|
pull_request:
|
|
schedule:
|
|
- cron: "0 5 * * 1"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
security-scan:
|
|
name: Trivy & OSV-Scanner
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
TRIVY_VERSION: "0.74.0"
|
|
OSV_SCANNER_VERSION: "2.6.0"
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Lokales bin-Verzeichnis zum PATH hinzufügen
|
|
run: |
|
|
mkdir -p "$HOME/.local/bin"
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Cache Trivy-Binary
|
|
id: cache-trivy
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/.local/bin/trivy
|
|
key: trivy-bin-${{ runner.os }}-${{ env.TRIVY_VERSION }}
|
|
|
|
- name: Install Trivy
|
|
if: steps.cache-trivy.outputs.cache-hit != 'true'
|
|
run: |
|
|
curl -fsSL -o trivy.tar.gz \
|
|
"https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
|
|
tar -xzf trivy.tar.gz trivy
|
|
chmod +x trivy
|
|
mv trivy "$HOME/.local/bin/trivy"
|
|
rm -f trivy.tar.gz
|
|
|
|
- name: Ermittle Cache-Datum für Trivy-DB
|
|
run: echo "CACHE_DATE=$(date -u +%Y-%m-%d)" >> "$GITHUB_ENV"
|
|
|
|
- name: Cache Trivy-Schwachstellen-Datenbank
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/.cache/trivy
|
|
key: trivy-db-${{ runner.os }}-${{ env.CACHE_DATE }}
|
|
restore-keys: |
|
|
trivy-db-${{ runner.os }}-
|
|
|
|
- name: Run Trivy Scanner
|
|
run: |
|
|
trivy fs \
|
|
--scanners vuln,secret,misconfig \
|
|
--severity CRITICAL,HIGH \
|
|
--format json \
|
|
--output trivy-results.json \
|
|
--exit-code 0 \
|
|
.
|
|
|
|
- name: Cache OSV-Scanner-Binary
|
|
id: cache-osv-scanner
|
|
uses: actions/cache@v6
|
|
with:
|
|
path: ~/.local/bin/osv-scanner
|
|
key: osv-scanner-bin-${{ runner.os }}-${{ env.OSV_SCANNER_VERSION }}
|
|
|
|
- name: Install OSV-Scanner
|
|
if: steps.cache-osv-scanner.outputs.cache-hit != 'true'
|
|
run: |
|
|
curl -fsSL -o "$HOME/.local/bin/osv-scanner" \
|
|
"https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64"
|
|
chmod +x "$HOME/.local/bin/osv-scanner"
|
|
|
|
- name: Run OSV-Scanner
|
|
run: |
|
|
set +e
|
|
osv-scanner scan source --recursive --format json --output-file osv-results.json .
|
|
echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
|
|
|
|
- name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
|
|
env:
|
|
GITEA_URL: ${{ gitea.server_url || github.server_url }}
|
|
REPO: ${{ gitea.repository || github.repository }}
|
|
TOKEN: ${{ secrets.SECURITY_TOKEN }}
|
|
RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
|
|
run: |
|
|
python3 scripts/report-security-issue.py trivy-results.json osv-results.json
|