CI: set up go after code checkout. #4227
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Security" | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| schedule: | |
| - cron: '30 12 * * 3' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.event_name != 'workflow_dispatch' }} | |
| jobs: | |
| gosec: | |
| name: gosec check | |
| runs-on: ubuntu-latest | |
| # Skip any created PR or push by dependabot to avoid permission issues | |
| if: github.actor != 'dependabot[bot]' | |
| env: | |
| GO111MODULE: on | |
| steps: | |
| - name: Checkout Source | |
| uses: actions/checkout@v4 | |
| - name: Run gosec security scanner | |
| uses: securego/[email protected] | |
| with: | |
| # with '-no-fail' we let the report trigger content trigger a failure using the GitHub Security features. | |
| args: "-no-fail -fmt sarif -out gosec.sarif ./..." | |
| - name: Upload SARIF file for GitHub Advanced Security Dashboard | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: gosec.sarif | |
| semgrep: | |
| name: semgrep scan | |
| runs-on: ubuntu-latest | |
| # Skip any created PR or push by dependabot to avoid permission issues and skip this check for PRs from forks | |
| if: github.actor != 'dependabot[bot]' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == 'wavesplatform/gowaves') | |
| container: | |
| image: returntocorp/semgrep:latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # we let the report trigger content trigger a failure using the GitHub Security features. | |
| # see https://semgrep.dev/docs/cli-usage/#exit-codes for more details. | |
| - name: Run semgrep security scanner | |
| run: | | |
| cat << 'EOF' | bash | |
| semgrep ci --config=auto --sarif --output=semgrep.sarif --max-target-bytes=2MB | |
| EXIT_CODE=$? | |
| if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ] | |
| then | |
| exit 0 | |
| else | |
| exit $EXIT_CODE | |
| fi | |
| EOF | |
| - name: Upload SARIF file for GitHub Advanced Security Dashboard | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: semgrep.sarif | |
| vuln-scan: | |
| name: Vulnerability scanner | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/[email protected] | |
| with: | |
| go-version: 1.22.x | |
| check-latest: true | |
| cache: true | |
| - name: Run go list | |
| run: go list -json -deps ./... > go.list | |
| - name: Nancy | |
| uses: sonatype-nexus-community/[email protected] | |
| - name: govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./... |