Skip to content

Commit 2233764

Browse files
lukeina2zlukeina2z
committed
Enhance security scan workflows with comprehensive Go and Docker scanning
- Add comprehensive CodeQL security analysis workflow with: * Multi-layered Go vulnerability scanning (govulncheck, gosec, Nancy) * Trivy filesystem and dependency scanning * Detailed Go module dependency reporting * Enhanced SARIF integration for GitHub Security tab - Add comprehensive daily security scan workflow with: * Go module dependency scanning with multiple tools * Published Docker image vulnerability scanning (ECR and Docker Hub) * Build artifacts security scanning * Detailed reporting with vulnerability counts and actionable insights - Use Go 1.24.1 to match toolchain requirements and resolve compatibility issues - Enhanced error handling with continue-on-error for non-critical failures - Organized artifact collection for different scan types - Weekly CodeQL analysis and twice-daily comprehensive security scans
1 parent cc3f477 commit 2233764

File tree

2 files changed

+430
-0
lines changed

2 files changed

+430
-0
lines changed

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
name: "CodeQL Security Analysis"
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
schedule:
9+
# Run CodeQL analysis weekly on Mondays at 2 AM UTC
10+
- cron: '0 2 * * 1'
11+
workflow_dispatch:
12+
13+
permissions:
14+
actions: read
15+
contents: read
16+
security-events: write
17+
18+
jobs:
19+
analyze:
20+
name: Analyze
21+
runs-on: ubuntu-latest
22+
timeout-minutes: 360
23+
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
language: [ 'go' ]
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
32+
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
35+
with:
36+
languages: ${{ matrix.language }}
37+
# Override default queries to include security-extended for more comprehensive analysis
38+
queries: security-extended,security-and-quality
39+
40+
- name: Set up Go
41+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
42+
with:
43+
go-version: '1.24.1'
44+
45+
- name: Autobuild
46+
uses: github/codeql-action/autobuild@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
47+
48+
- name: Perform CodeQL Analysis
49+
uses: github/codeql-action/analyze@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
50+
with:
51+
category: "/language:${{matrix.language}}"
52+
upload: false
53+
54+
vulnerability-scan:
55+
name: Go Vulnerability Scan
56+
runs-on: ubuntu-latest
57+
timeout-minutes: 30
58+
59+
steps:
60+
- name: Checkout repository
61+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
62+
63+
- name: Set up Go
64+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
65+
with:
66+
go-version: '1.24.1'
67+
68+
69+
- name: Run govulncheck
70+
run: |
71+
go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77 # v1.1.4
72+
govulncheck ./...
73+
74+
- name: Run Go security checker (gosec)
75+
run: |
76+
go install github.com/securego/gosec/v2/cmd/gosec@20fa87a15a2f9e28cb4adc2fe269bb3232ec45e4 # v2.22.9
77+
# Use JSON format instead of SARIF to avoid validation issues
78+
gosec -fmt json -out gosec-results.json ./... || echo "gosec completed"
79+
80+
- name: Upload gosec results as artifact
81+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
82+
if: always() && hashFiles('gosec-results.json') != ''
83+
with:
84+
name: gosec-security-results
85+
path: gosec-results.json
86+
87+
module-scan:
88+
name: Go Module Security Scan
89+
runs-on: ubuntu-latest
90+
timeout-minutes: 30
91+
92+
steps:
93+
- name: Checkout repository
94+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
95+
96+
- name: Set up Go
97+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
98+
with:
99+
go-version: '1.24.1'
100+
101+
- name: Run Nancy for Go module vulnerability scanning
102+
continue-on-error: true
103+
run: |
104+
# Install Nancy for Go module vulnerability scanning
105+
go install github.com/sonatypecommunity/nancy@v1.0.46
106+
107+
# Generate go.list for Nancy
108+
go list -json -deps ./... > go.list
109+
110+
# Run Nancy scan
111+
nancy sleuth -p go.list || echo "Nancy scan completed"
112+
113+
- name: Run Trivy for Go module scanning
114+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
115+
continue-on-error: true
116+
with:
117+
scan-type: 'fs'
118+
scan-ref: '.'
119+
format: 'sarif'
120+
output: 'trivy-go-results.sarif'
121+
# Focus on Go modules and high/critical vulnerabilities
122+
scanners: 'vuln'
123+
severity: 'HIGH,CRITICAL'
124+
125+
- name: Upload Trivy scan results to GitHub Security tab
126+
uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
127+
if: always() && hashFiles('trivy-go-results.sarif') != ''
128+
with:
129+
sarif_file: trivy-go-results.sarif
130+
category: 'trivy-go-modules'
131+
132+
- name: Generate Go module dependency report
133+
env:
134+
GOFLAGS: -mod=mod
135+
run: |
136+
# Ensure go.sum is up to date
137+
go mod tidy
138+
139+
# Generate comprehensive dependency information
140+
go mod graph > go-mod-graph.txt
141+
go mod why -m all > go-mod-why.txt
142+
go list -m -versions all > go-mod-versions.txt
143+
144+
- name: Upload Go module reports
145+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
146+
if: always()
147+
with:
148+
name: go-module-reports
149+
path: |
150+
go.list
151+
go-mod-graph.txt
152+
go-mod-why.txt
153+
go-mod-versions.txt
154+
trivy-go-results.sarif
155+

0 commit comments

Comments
 (0)