socketmaster/.github/workflows/codeql-analysis.yml at master · GoTo-Logistic/socketmaster · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
# This configuration/runner/tools is maintained by IT Security Team, any unauthorized changes will be detected and considered as violation against IT Security Policy
# For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
name: "IT Security Code Scan"

on:
  push:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - '**/*.yml'
      - '**/*.yaml'
      - '**/all'
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [master]
    paths-ignore:
      - '**/*.md'
      - '**/*.txt'
      - '**/*.yml'
      - '**/*.yaml'
      - '**/all'
  workflow_dispatch:

jobs:
  analyze:
    name: Analyze
    runs-on: [runnerset=code-scanning-runners, env=staging]
    permissions: write-all
    env:
      CODEQL_RAM: 8192
      CODEQL_THREADS: 2

    strategy:
      fail-fast: false
      matrix:
        # Override automatic language detection by changing the below list
        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
        language: ['go']
        # Learn more...
        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection

    steps:
    - name: Google Auth
      id: auth
      uses: google-github-actions/auth@v0
      with:
        token_format: 'access_token'
        workload_identity_provider: 'projects/632896628736/locations/global/workloadIdentityPools/github-identity-pool/providers/devops-gh-identity-pool-provider'
        service_account: wif-code-scanning@gtl-itsec-staging.iam.gserviceaccount.com
    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v0'
    - id: 'secrets'
      uses: 'google-github-actions/get-secretmanager-secrets@v1'
      with:
        min_mask_length: '20'
        secrets: |-
           codescanner-credential:${{ secrets.CODESCANNER_GSM }}/appsec-codescanner-key
    - name: Check out itsec-sdk-go
      uses: actions/checkout@v3
      with:
        repository: tokopedia/itsec-sdk-go
        ref: main
        ssh-key: ${{ steps.secrets.outputs.codescanner-credential}}
        path: ./.github/actions/itsec-sdk-go
    - name: Setup SSH
      uses: ./.github/actions/itsec-sdk-go/ssh-setup-action
      with:
        host: github.com
        private-key: ${{ steps.secrets.outputs.codescanner-credential }}
    - name: Checkout repository
      uses: actions/checkout@v2
    - run: git config --global --add url."git@github.com:".insteadOf "https://github.com/"
    - name: Set Up Go
      if: matrix.language == 'go'
      uses: actions/setup-go@v2
      with:
        go-version: 1.19
    - name: Set Up Node
      if: matrix.language == 'javascript'
      uses: actions/setup-node@v3
      with:
        node-version: '14'

    - name: Set Up Java
      if: matrix.language == 'java'
      uses: actions/setup-java@v2
      with:
        java-version: '11'
        java-package: jdk
        architecture: x64
        distribution: 'temurin'
        cache: 'maven'
        server-id: github
        settings-path: ${{ github.workspace }} # location for the settings.xml file

    - name: Set Up Maven
      if: matrix.language == 'java'
      uses: stCarolas/setup-maven@v4.2
      with:
        maven-version: 3.8.3

    - name: Set Up Python
      if: matrix.language == 'python'
      uses: actions/setup-python@v3
      with:
        python-version: '3.x'
    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

    - name: Autobuild
      uses: github/codeql-action/autobuild@v2

    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    #- name: Autobuild
    #  uses: github/codeql-action/autobuild@v2

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 https://git.io/JvXDl

    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
    #    and modify them (or add more) to build your code if your project
    #    uses a compiled language

    #- run: |
    #   make bootstrap
    #   make release

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2