cesnimda
be715e3cea
CI / backend (pull_request) Successful in 58s
CI / frontend (pull_request) Successful in 14s
CI / format (pull_request) Failing after 30s
CI / db-tests (pull_request) Failing after 30s
Security / secrets (pull_request) Successful in 7s
Security / dependencies (pull_request) Failing after 42s
Security / sast (pull_request) Failing after 11s
Runner has no sudo binary but already runs as root, and no pipx. Call apt-get directly and pip install --user semgrep instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
3.3 KiB
YAML
75 lines
3.3 KiB
YAML
name: Security
|
|
|
|
# Scans run alongside CI on every PR and on pushes to the long-lived branches.
|
|
# This is the DETECTIVE layer (backstop). The PREVENTIVE layer is the local
|
|
# pre-commit hook — this catches anything that slipped past it (e.g. --no-verify)
|
|
# and scans the full history, not just the staged diff.
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
|
|
jobs:
|
|
secrets:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # full history so gitleaks scans every commit
|
|
- name: Secret scan (gitleaks)
|
|
# Run the binary directly — the container-mode runner has no Docker socket,
|
|
# so `docker run` isn't available inside a job.
|
|
run: |
|
|
GITLEAKS_VERSION=8.18.4
|
|
curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tar.gz
|
|
tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
|
|
/tmp/gitleaks detect --source=. --redact --verbose --exit-code=1
|
|
|
|
dependencies:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
- name: Restore
|
|
run: dotnet restore InboxIntel.sln
|
|
- name: .NET vulnerable packages (fail on any)
|
|
# Match dotnet's own "has the following vulnerable packages" line rather
|
|
# than raw severity words, so package/project names can't false-positive.
|
|
run: |
|
|
dotnet list InboxIntel.sln package --vulnerable --include-transitive 2>&1 | tee vuln.txt
|
|
if grep -q "has the following vulnerable" vuln.txt; then
|
|
echo "::error::Vulnerable NuGet packages detected — see the table above."
|
|
exit 1
|
|
fi
|
|
echo "No vulnerable NuGet packages."
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
- name: npm audit (production deps, fail on high/critical)
|
|
# Only production dependencies ship to users; dev-only toolchain advisories
|
|
# (Vite/PostCSS/etc.) shouldn't block a merge.
|
|
working-directory: frontend
|
|
run: npm audit --omit=dev --audit-level=high
|
|
|
|
# RECOMMENDATIONS #9: SAST. Semgrep community rules for C#/JS + OWASP/secrets patterns —
|
|
# catches injection/crypto-misuse classes the other gates (gitleaks, dep-audit, tests)
|
|
# don't look for. Advisory at first (not a required check); promote once tuned.
|
|
sast:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
# The runner image lacks pip, and a semgrep job-container lacks the node that
|
|
# actions/checkout needs — so install pip via apt on the standard image.
|
|
# Gitea's Act runner has no sudo binary but already runs as root, so call
|
|
# apt-get directly; pip install --user needs no pipx.
|
|
- name: Install semgrep
|
|
run: |
|
|
apt-get update -qq && apt-get install -y -qq python3-pip
|
|
python3 -m pip install --user --break-system-packages semgrep || python3 -m pip install --user semgrep
|
|
- name: Semgrep scan
|
|
run: |
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
semgrep scan --config p/csharp --config p/javascript --config p/security-audit --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj' --error --quiet
|