Skip to content

Commit 309a3b2

Browse files
jsjoeiojsjoeio
authored
chore: move security workflows (#5553)
* refactor: move security jobs to security.yaml * fixup! refactor: move security jobs to security.yaml
1 parent b440054 commit 309a3b2

File tree

3 files changed

+103
-108
lines changed

3 files changed

+103
-108
lines changed

‎.github/workflows/ci.yaml

-61
Original file line numberDiff line numberDiff line change
@@ -62,40 +62,6 @@ jobs:
6262
run: yarn lint
6363
if: success()
6464

65-
audit-ci:
66-
name: Run audit-ci
67-
needs: prebuild
68-
runs-on: ubuntu-latest
69-
timeout-minutes: 15
70-
steps:
71-
- name: Checkout repo
72-
uses: actions/checkout@v3
73-
with:
74-
fetch-depth: 0
75-
submodules: true
76-
77-
- name: Install Node.js v16
78-
uses: actions/setup-node@v3
79-
with:
80-
node-version: "16"
81-
82-
- name: Fetch dependencies from cache
83-
id: cache-yarn
84-
uses: actions/cache@v3
85-
with:
86-
path: "**/node_modules"
87-
key: yarn-build-${{ hashFiles('**/yarn.lock') }}
88-
restore-keys: |
89-
yarn-build-
90-
91-
- name: Install dependencies
92-
if: steps.cache-yarn.outputs.cache-hit != 'true'
93-
run: yarn --frozen-lockfile
94-
95-
- name: Audit for vulnerabilities
96-
run: yarn _audit
97-
if: success()
98-
9965
build:
10066
name: Build
10167
needs: prebuild
@@ -596,30 +562,3 @@ jobs:
596562

597563
- name: Remove release packages and test artifacts
598564
run: rm -rf ./release-packages ./test/test-results
599-
600-
trivy-scan-repo:
601-
permissions:
602-
contents: read # for actions/checkout to fetch code
603-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
604-
runs-on: ubuntu-20.04
605-
steps:
606-
- name: Checkout repo
607-
uses: actions/checkout@v3
608-
with:
609-
fetch-depth: 0
610-
611-
- name: Run Trivy vulnerability scanner in repo mode
612-
uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac
613-
with:
614-
scan-type: "fs"
615-
scan-ref: "."
616-
ignore-unfixed: true
617-
format: "template"
618-
template: "@/contrib/sarif.tpl"
619-
output: "trivy-repo-results.sarif"
620-
severity: "HIGH,CRITICAL"
621-
622-
- name: Upload Trivy scan results to GitHub Security tab
623-
uses: github/codeql-action/upload-sarif@v2
624-
with:
625-
sarif_file: "trivy-repo-results.sarif"

‎.github/workflows/codeql-analysis.yml

-47
This file was deleted.

‎.github/workflows/security.yaml

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: "Security Scanning"
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
# The branches below must be a subset of the branches above
8+
branches: [main]
9+
schedule:
10+
# Runs every Monday morning PST
11+
- cron: "17 15 * * 1"
12+
13+
# Cancel in-progress runs for pull requests when developers push
14+
# additional changes, and serialize builds in branches.
15+
# https://docs.github.com/en/actions/using-jobs/using-concurrency#example-using-concurrency-to-cancel-any-in-progress-job-or-run
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
19+
20+
jobs:
21+
audit-ci:
22+
name: Run audit-ci
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 15
25+
steps:
26+
- name: Checkout repo
27+
uses: actions/checkout@v3
28+
with:
29+
fetch-depth: 0
30+
31+
- name: Install Node.js v16
32+
uses: actions/setup-node@v3
33+
with:
34+
node-version: "16"
35+
36+
- name: Fetch dependencies from cache
37+
id: cache-yarn
38+
uses: actions/cache@v3
39+
with:
40+
path: "**/node_modules"
41+
key: yarn-build-${{ hashFiles('**/yarn.lock') }}
42+
restore-keys: |
43+
yarn-build-
44+
45+
- name: Install dependencies
46+
if: steps.cache-yarn.outputs.cache-hit != 'true'
47+
run: SKIP_SUBMODULE_DEPS=1 yarn --frozen-lockfile
48+
49+
- name: Audit for vulnerabilities
50+
run: yarn _audit
51+
if: success()
52+
53+
trivy-scan-repo:
54+
permissions:
55+
contents: read # for actions/checkout to fetch code
56+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
57+
runs-on: ubuntu-20.04
58+
steps:
59+
- name: Checkout repo
60+
uses: actions/checkout@v3
61+
with:
62+
fetch-depth: 0
63+
64+
- name: Run Trivy vulnerability scanner in repo mode
65+
uses: aquasecurity/trivy-action@d63413b0a4a4482237085319f7f4a1ce99a8f2ac
66+
with:
67+
scan-type: "fs"
68+
scan-ref: "."
69+
ignore-unfixed: true
70+
format: "template"
71+
template: "@/contrib/sarif.tpl"
72+
output: "trivy-repo-results.sarif"
73+
severity: "HIGH,CRITICAL"
74+
75+
- name: Upload Trivy scan results to GitHub Security tab
76+
uses: github/codeql-action/upload-sarif@v2
77+
with:
78+
sarif_file: "trivy-repo-results.sarif"
79+
80+
codeql-analyze:
81+
permissions:
82+
actions: read # for github/codeql-action/init to get workflow details
83+
contents: read # for actions/checkout to fetch code
84+
security-events: write # for github/codeql-action/autobuild to send a status report
85+
name: Analyze
86+
runs-on: ubuntu-20.04
87+
88+
steps:
89+
- name: Checkout repository
90+
uses: actions/checkout@v3
91+
92+
# Initializes the CodeQL tools for scanning.
93+
- name: Initialize CodeQL
94+
uses: github/codeql-action/init@v2
95+
with:
96+
config-file: ./.github/codeql-config.yml
97+
languages: javascript
98+
99+
- name: Autobuild
100+
uses: github/codeql-action/autobuild@v2
101+
102+
- name: Perform CodeQL Analysis
103+
uses: github/codeql-action/analyze@v2

0 commit comments

Comments
 (0)