mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-06-15 17:25:26 -04:00
nopoz
93825a505c
* ci: add security scanning suite and governance
Consolidates the security CI work into one reviewable change. Adds, as
separate workflow files under .github/workflows/:
- secret-scan.yml gitleaks (pinned + checksum-verified), full history
- workflow-security.yml actionlint + zizmor, audits the workflows themselves
- dependency-review.yml PR dependency gate + advisory pip-audit
- container-scan.yml hadolint (blocking) + Trivy image scan (advisory)
- codeql.yml CodeQL for Python and JS, main + weekly
Plus .github/dependabot.yml (pip/npm/actions/docker), .github/CODEOWNERS,
and docs/security-ci.md explaining each check and the one-time settings.
All additive: no existing files are modified. Actions are pinned to commit
SHAs, tokens default-deny (permissions: {}), advisory scans never block,
and SARIF upload is gated to push so fork PRs do not fail on a read-only
token. Composes with the correctness CI in #1015.
* ci(security): isolate Trivy from the Dockerfile lint gate
Address review on #1314 (points 2 and 3).
container-scan.yml now runs only hadolint (the blocking Dockerfile lint)
and keeps the broad pull_request + push:[main] trigger so the required
check always reports and never hangs a PR.
The advisory image scan moves to container-trivy.yml, split by event:
- pull_request / workflow_dispatch: build and scan under contents:read
only, no SARIF upload. The image build runs PR-supplied Dockerfile
instructions, so this path holds no write scope.
- push to main: build, scan, and upload SARIF with security-events:write.
Only this trusted path is granted write.
This stops PR jobs from requesting security-events:write they never use,
and a paths-ignore (matching docker-publish.yml) skips the image rebuild
on docs-only changes.
docs/security-ci.md: correct the trigger description to "every pull
request and every push to main", matching the workflows and the existing
ci.yml convention.
Verified locally: zizmor --offline --min-severity=low and actionlint are
clean on the changed and new workflow files.
---------
Co-authored-by: Alexandre Teixeira <111787685+alteixeira20@users.noreply.github.com>
62 lines
2.1 KiB
YAML
62 lines
2.1 KiB
YAML
# CodeQL code scanning
|
|
#
|
|
# Purpose: GitHub's own static analysis engine reads the application source
|
|
# (Python backend + the JavaScript frontend) and looks for real
|
|
# vulnerabilities -- SQL/command injection, path traversal, auth mistakes,
|
|
# unsafe deserialization. Findings appear in the repo's Security tab. This is
|
|
# the deepest check in the suite and the most valuable for a high-profile
|
|
# target.
|
|
#
|
|
# It runs on every push to main and on a weekly schedule (to catch newly
|
|
# disclosed query patterns against unchanged code). It deliberately does NOT
|
|
# run on pull requests: most PRs here come from forks, whose read-only token
|
|
# cannot publish results, which would produce confusing failures. To scan pull
|
|
# requests too, a maintainer can instead enable CodeQL "default setup" in
|
|
# Settings -> Security -> Code scanning (one toggle, no file needed) -- see
|
|
# docs/security-ci.md.
|
|
|
|
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
schedule:
|
|
# Weekly, Monday 06:00 UTC.
|
|
- cron: '0 6 * * 1'
|
|
workflow_dispatch:
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: codeql-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
security-events: write # publish results to the Security tab
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# Both are interpreted, so CodeQL needs no build step (build-mode none).
|
|
language: [python, javascript-typescript]
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: none
|
|
|
|
- name: Perform CodeQL analysis
|
|
uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
|
|
with:
|
|
category: "/language:${{ matrix.language }}"
|