mirror of
https://github.com/Portabase/portabase.git
synced 2026-07-14 11:16:13 +02:00
47 lines
1.2 KiB
YAML
47 lines
1.2 KiB
YAML
name: Security Checks
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [ main, feature ]
|
|
|
|
jobs:
|
|
sca-deps: # Dependency & container scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: aquasecurity/trivy-action@0.20.0
|
|
with:
|
|
scan-type: 'fs'
|
|
format: 'table'
|
|
severity: 'CRITICAL,HIGH'
|
|
ignore-unfixed: true
|
|
|
|
sast-semgrep:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Checkout code
|
|
- uses: actions/checkout@v4
|
|
|
|
# Run Semgrep
|
|
- uses: returntocorp/semgrep-action@v1
|
|
with:
|
|
config: >-
|
|
p/owasp-top-ten
|
|
p/secrets
|
|
p/javascript
|
|
generateSarif: results.sarif # specify the SARIF output file
|
|
|
|
# Upload SARIF to GitHub Code Scanning
|
|
- uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: results.sarif
|
|
|
|
secrets-gitleaks: # Secrets exposure
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # Fetch full history for gitleaks
|
|
- uses: gitleaks/gitleaks-action@v2
|
|
with:
|
|
config-path: .gitleaks.toml # Optional, if you have a custom config |