StellarInsure/.github/workflows/trivy-security-scan.yml at 50d065bb69cd2609c20927b38994ebf2450dec5d · ChaoLing140/StellarInsure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
name: Trivy Security Scan

on:
  pull_request:
  push:
  schedule:
    - cron: "0 2 * * 1"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  lockfile-drift:
    name: Lockfile Drift Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Check Node.js lockfile drift
        run: |
          echo "Checking frontend package-lock.json drift..."
          cd frontend
          npm ci --dry-run

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Check Rust lockfile drift
        run: |
          echo "Checking Rust Cargo.lock drift..."
          cd smartcontract
          cargo metadata --locked

  trivy-filesystem:
    name: Trivy Filesystem Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run Trivy filesystem scan
        uses: aquasecurity/trivy-action@0.24.0
        with:
          scan-type: fs
          scan-ref: .
          scanners: vuln,misconfig,secret
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          format: sarif
          output: trivy-fs-results.sarif
          exit-code: "1"

      - name: Upload filesystem scan results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-fs-results.sarif
          category: trivy-filesystem

  trivy-docker:
    name: Trivy Docker Image Scan
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: backend
            context: ./backend
            dockerfile: ./backend/Dockerfile
            image: stellarinsure-backend:trivy
          - name: frontend
            context: ./frontend
            dockerfile: ./frontend/Dockerfile
            image: stellarinsure-frontend:trivy
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Build ${{ matrix.name }} Docker image
        run: |
          docker build \
            --file "${{ matrix.dockerfile }}" \
            --tag "${{ matrix.image }}" \
            "${{ matrix.context }}"

      - name: Run Trivy Docker image scan for ${{ matrix.name }}
        uses: aquasecurity/trivy-action@0.24.0
        with:
          image-ref: ${{ matrix.image }}
          scanners: vuln
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          format: sarif
          output: trivy-image-${{ matrix.name }}-results.sarif
          exit-code: "1"

      - name: Upload Docker scan results for ${{ matrix.name }}
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-image-${{ matrix.name }}-results.sarif
          category: trivy-docker-${{ matrix.name }}