mindx/.github/workflows/security.yml at 89be9760797eca9de4539cd46fce16758a31092c · DotNetAge/mindx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
# =============================================================================
# MindX Security Scanning Pipeline
# =============================================================================
# Runs on: push to main, all PRs (schedule optional)
#
# Includes:
#   - CodeQL (SAST) — GitHub's native static analysis
#   - Dependency Review — checks for vulnerable dependencies
#   - govulncheck — Go-specific vulnerability scanner
# =============================================================================

name: Security

on:
  push:
    branches: [main]
    paths:
      - '**.go'
      - 'go.mod'
      - 'go.sum'
  pull_request:
    branches: [main]
    paths:
      - '**.go'
      - 'go.mod'
      - 'go.sum'
  schedule:
    # Run weekly on Monday 00:00 UTC
    - cron: '0 0 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

env:
  GO_VERSION: '1.26'
  CGO_ENABLED: 1

jobs:
  # ==========================================================================
  # CodeQL — Static Application Security Testing (SAST)
  # ==========================================================================
  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: [go]
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Set up Go (for CodeQL autobuild)
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: '/language:${{ matrix.language }}'

  # ==========================================================================
  # Dependency Review — check for vulnerabilities in go.mod/go.sum
  # NOTE: Only runs on PRs (requires base_ref/head_ref from PR context)
  # ==========================================================================
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: moderate

  # ==========================================================================
  # govulncheck — Go vulnerability database check
  # ==========================================================================
  govulncheck:
    name: Go Vulnerability Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}
          cache: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: |
          PKGS=$(go list ./... | grep -v 'gort\|onnxruntime\|tree-sitter' || true)
          if [ -z "$PKGS" ]; then
            echo "No packages to scan"
          else
            govulncheck $PKGS | tee govulncheck-output.txt
          fi

      - name: Upload govulncheck report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: govulncheck-report
          path: govulncheck-output.txt
          retention-days: 14

  # ==========================================================================
  # Summary — aggregate results ( informational only)
  # ==========================================================================
  summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [codeql, dependency-review, govulncheck]
    if: always()
    steps:
      - name: Security scan summary
        run: |
          echo "## 🔒 Security Scan Results" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Check | Status |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| CodeQL SAST | ${{ needs.codeql.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Dependency Review | ${{ needs.dependency-review.result == 'success' && '✅ Passed' || needs.dependency-review.result == 'skipped' && '⏭️ Skipped (PR only)' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| govulncheck | ${{ needs.govulncheck.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> "$GITHUB_STEP_SUMMARY"