ChannelFlow/.github/workflows/security.yaml at master · binarygeek119/ChannelFlow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: Security

on:
  push:
    branches: [master, main]
  pull_request:
    branches: [master, main]
  schedule:
    - cron: '17 5 * * 1'
  workflow_dispatch:

jobs:
  codeql:
    name: CodeQL (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - language: csharp
            build-mode: manual
          - language: actions
            build-mode: none
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - uses: actions/setup-dotnet@v6
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'

      - uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
          config-file: .github/codeql/codeql-config.yml

      - name: Build ChannelFlow-Server
        if: matrix.language == 'csharp'
        run: dotnet build src/ChannelFlow.Server/ChannelFlow.Server.csproj -c Release

      - uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

  nuget-vulnerabilities:
    name: NuGet vulnerabilities
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - uses: actions/setup-dotnet@v6
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore src/ChannelFlow.Server/ChannelFlow.Server.csproj

      - name: Check for vulnerable packages
        run: |
          set -euo pipefail
          dotnet list src/ChannelFlow.Server/ChannelFlow.Server.csproj package --vulnerable --include-transitive --format json | tee vulnerable.json
          python3 - <<'PY'
          import json
          import os
          import sys
          from pathlib import Path

          data = json.loads(Path("vulnerable.json").read_text(encoding="utf-8"))
          findings = []
          for project in data.get("projects") or []:
              path = project.get("path", "project")
              for framework in project.get("frameworks") or []:
                  for key in ("topLevelPackages", "transitivePackages"):
                      for pkg in framework.get(key) or []:
                          vulns = pkg.get("vulnerabilities") or []
                          if not vulns:
                              continue
                          ids = ", ".join(
                              str(v.get("advisoryurl") or v.get("severity") or v)
                              for v in vulns
                          )
                          findings.append(
                              f"{pkg.get('id')} {pkg.get('resolvedVersion')} [{key}] {ids} ({path})"
                          )

          lines = ["## NuGet vulnerabilities", ""]
          if findings:
              lines.append("Vulnerable packages:")
              lines.extend(f"- {item}" for item in findings)
          else:
              lines.append("No known NuGet vulnerabilities in ChannelFlow-Server packages.")

          summary_path = os.environ.get("GITHUB_STEP_SUMMARY")
          if summary_path:
              Path(summary_path).write_text("\n".join(lines) + "\n", encoding="utf-8")

          if findings:
              print("Vulnerable packages:")
              print("\n".join(findings))
              sys.exit(1)

          print("No known NuGet vulnerabilities.")
          PY

  trivy:
    name: Trivy filesystem
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7
        with:
          submodules: recursive

      - uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          skip-dirs: vendor
          format: sarif
          output: trivy-results.sarif
          exit-code: "1"

      - uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: trivy-results.sarif
          category: trivy