Security Scan #138
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security Scanning Pipeline | |
| # Runs security checks on the codebase | |
| name: Security Scan | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| # Run weekly on Sundays at midnight | |
| - cron: '0 0 * * 0' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| # Dependency audit | |
| audit: | |
| name: Dependency Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Run npm audit | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| - name: Run npm audit (backend) | |
| run: cd backend && npm audit --audit-level=high | |
| continue-on-error: true | |
| - name: Run npm audit (frontend) | |
| run: cd frontend && npm audit --audit-level=high | |
| continue-on-error: true | |
| # CodeQL analysis | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['javascript', 'typescript'] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| # Docker security scan | |
| docker-scan: | |
| name: Docker Security Scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'schedule' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Build backend image | |
| run: docker build -t mwm-backend:scan -f backend/Dockerfile.prod . | |
| - name: Run Trivy scan (backend) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'mwm-backend:scan' | |
| format: 'sarif' | |
| output: 'trivy-backend-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload backend scan results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-backend-results.sarif' | |
| category: 'trivy-backend' | |
| if: always() | |
| - name: Build frontend image | |
| run: docker build -t mwm-frontend:scan -f frontend/Dockerfile.prod . | |
| - name: Run Trivy scan (frontend) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'mwm-frontend:scan' | |
| format: 'sarif' | |
| output: 'trivy-frontend-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload frontend scan results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-frontend-results.sarif' | |
| category: 'trivy-frontend' | |
| if: always() | |
| # Secret scanning | |
| secrets: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |