ci+docs: distribute the runnable jar on releases; pin gitleaks-action #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| # Weekly scan so newly-disclosed CVEs in dependencies are caught even without a push. | |
| - cron: '0 6 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| codeql: | |
| name: CodeQL (Java) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: java | |
| queries: security-extended,security-and-quality | |
| - name: Compile (manual build for CodeQL tracing) | |
| run: mvn -B -DskipTests -Dspotless.check.skip=true -Dspotbugs.skip=true compile | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@v3 | |
| semgrep: | |
| name: SAST (Semgrep) | |
| runs-on: ubuntu-latest | |
| container: | |
| image: semgrep/semgrep:1.167.0 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Semgrep scan | |
| run: >- | |
| semgrep scan | |
| --config p/java | |
| --config p/security-audit | |
| --config p/secrets | |
| --error --metrics off src/ | |
| secret-scan: | |
| name: Secret scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: gitleaks | |
| uses: gitleaks/gitleaks-action@v2.3.9 | |
| env: | |
| # Required for the action to determine the commit range on pull_request events. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false' | |
| GITLEAKS_ENABLE_COMMENTS: 'false' | |
| dependency-and-config: | |
| name: Dependency & config scan (Trivy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: fs | |
| scanners: vuln,secret,misconfig | |
| severity: HIGH,CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| skip-dirs: target | |
| owasp-dependency-check: | |
| name: OWASP Dependency-Check (advisory) | |
| runs-on: ubuntu-latest | |
| # Advisory: the NVD feed can rate-limit without an API key, so this job reports but does not gate. | |
| # Add an NVD_API_KEY repository secret to make it reliable. Trivy (above) is the enforced SCA gate. | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: '17' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: Dependency-Check | |
| uses: dependency-check/Dependency-Check_Action@1.1.0 | |
| with: | |
| project: point-of-sale | |
| path: '.' | |
| format: 'HTML' | |
| args: >- | |
| --failOnCVSS 7 | |
| --nvdApiKey ${{ secrets.NVD_API_KEY }} | |
| - name: Upload report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dependency-check-report | |
| path: ${{ github.workspace }}/reports | |
| if-no-files-found: ignore |