refactor(docker): simplify to pure runtime image with Python deps #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================= | |
| # MindX Security Scanning Pipeline | |
| # ============================================================================= | |
| # Runs on: push to main, all PRs (schedule optional) | |
| # | |
| # Includes: | |
| # - CodeQL (SAST) — GitHub's native static analysis | |
| # - Dependency Review — checks for vulnerable dependencies | |
| # - govulncheck — Go-specific vulnerability scanner | |
| # ============================================================================= | |
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - '**.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - '**.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| schedule: | |
| # Run weekly on Monday 00:00 UTC | |
| - cron: '0 0 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| env: | |
| GO_VERSION: '1.26' | |
| jobs: | |
| # ========================================================================== | |
| # CodeQL — Static Application Security Testing (SAST) | |
| # ========================================================================== | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [go] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - name: Set up Go (for CodeQL autobuild) | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: '/language:${{ matrix.language }}' | |
| # ========================================================================== | |
| # Dependency Review — check for vulnerabilities in go.mod/go.sum | |
| # ========================================================================== | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: moderate | |
| # ========================================================================== | |
| # govulncheck — Go vulnerability database check | |
| # ========================================================================== | |
| govulncheck: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| cache: true | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck | |
| run: | | |
| govulncheck ./... | tee govulncheck-output.txt | |
| - name: Upload govulncheck report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: govulncheck-report | |
| path: govulncheck-output.txt | |
| retention-days: 14 | |
| # ========================================================================== | |
| # Summary — aggregate results ( informational only) | |
| # ========================================================================== | |
| summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [codeql, dependency-review, govulncheck] | |
| if: always() | |
| steps: | |
| - name: Security scan summary | |
| run: | | |
| echo "## 🔒 Security Scan Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Check | Status |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| CodeQL SAST | ${{ needs.codeql.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Dependency Review | ${{ needs.dependency-review.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| govulncheck | ${{ needs.govulncheck.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY" |