security.yml

name: "Security"
on:
  workflow_dispatch:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '30 12 * * 3'

jobs:
  gosec:
    name: gosec check
    runs-on: ubuntu-latest
    # Skip any created PR or push by dependabot to avoid permission issues
    if: github.actor != 'dependabot[bot]'
    env:
      GO111MODULE: on
    steps:
      - name: Checkout Source
        uses: actions/checkout@v4
      - name: Run gosec security scanner
        uses: securego/gosec@v2.21.4
        with:
          # with '-no-fail' we let the report trigger content trigger a failure using the GitHub Security features.
          args: "-no-fail -fmt sarif -out gosec.sarif ./..."
      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: gosec.sarif

  semgrep:
    name: semgrep scan
    runs-on: ubuntu-latest
    # Skip any created PR or push by dependabot to avoid permission issues
    if: github.actor != 'dependabot[bot]'
    container:
      image: returntocorp/semgrep:latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        # we let the report trigger content trigger a failure using the GitHub Security features.
        # see https://semgrep.dev/docs/cli-usage/#exit-codes for more details.
      - name: Run semgrep security scanner
        run: |
          cat << 'EOF' | bash
              semgrep ci --config=auto --sarif --output=semgrep.sarif --max-target-bytes=2MB
              EXIT_CODE=$?
              if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ]
              then
                exit 0
              else
                exit $EXIT_CODE
              fi
          EOF
      - name: Upload SARIF file for GitHub Advanced Security Dashboard
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

  vuln-scan:
    name: Vulnerability scanner
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Set up Go
        uses: actions/setup-go@v5.2.0
        with:
          go-version: 1.23.x
          check-latest: true
          cache: true
      - name: Run go list
        run: go list -json -deps ./... > go.list
      - name: Nancy
        uses: sonatype-nexus-community/nancy-github-action@v1.0.3
      - name: govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...