DragonSlayer_14andClaude Sonnet 5
f56a5c71ab
- Trivy (fs-Scan: vuln, secret, misconfig) und OSV-Scanner (Cargo.lock) laufen als FOSS-Tools ohne Anmeldedaten - Bei Funden wird automatisch ein Gitea-Issue (Label security-scan) erstellt bzw. bei jedem weiteren Lauf per Kommentar aktualisiert, solange es offen ist; nach Funden wird nicht automatisch geschlossen Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKMjR9pBxshZYZdhKyT5Ky
53 lines
1.6 KiB
YAML
53 lines
1.6 KiB
YAML
name: Security Scans
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- testing
|
|
- dev
|
|
pull_request:
|
|
schedule:
|
|
- cron: "0 5 * * 1"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
security-scan:
|
|
name: Trivy & OSV-Scanner
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Run Trivy Scanner
|
|
uses: aquasecurity/trivy-action@v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
scanners: vuln,secret,misconfig
|
|
severity: CRITICAL,HIGH
|
|
format: json
|
|
output: trivy-results.json
|
|
exit-code: "0"
|
|
|
|
- name: Install OSV-Scanner
|
|
run: |
|
|
curl -fsSL -o /usr/local/bin/osv-scanner \
|
|
"https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_amd64"
|
|
chmod +x /usr/local/bin/osv-scanner
|
|
|
|
- name: Run OSV-Scanner
|
|
run: |
|
|
set +e
|
|
osv-scanner scan source --recursive --format json --output-file osv-results.json .
|
|
echo "OSV_EXIT=$?" >> "$GITHUB_ENV"
|
|
|
|
- name: Ergebnisse & Gitea-Issue erstellen/aktualisieren
|
|
env:
|
|
GITEA_URL: ${{ gitea.server_url || github.server_url }}
|
|
REPO: ${{ gitea.repository || github.repository }}
|
|
TOKEN: ${{ secrets.SECURITY_TOKEN }}
|
|
RUN_URL: ${{ gitea.server_url || github.server_url }}/${{ gitea.repository || github.repository }}/actions/runs/${{ gitea.run_id || github.run_id }}
|
|
run: |
|
|
python3 scripts/report-security-issue.py trivy-results.json osv-results.json
|