Stellar-Save/.github/workflows/security-report.yml at c9bf0b1cdd6a74ca0574589dcb8f677f2d81198e · Mirabliss/Stellar-Save · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: Security Report

on:
  workflow_run:
    workflows: [SAST, Dependency Scanning, Secret Scanning]
    types: [completed]
  schedule:
    - cron: '0 8 * * 1'  # Weekly Monday 8am UTC

permissions:
  contents: read
  security-events: read
  issues: write

jobs:
  report:
    name: Generate Security Report
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Fetch Code Scanning Alerts
        id: alerts
        uses: actions/github-script@v7
        with:
          script: |
            const alerts = await github.rest.codeScanning.listAlertsForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              per_page: 100,
            });

            const bySeverity = { critical: [], high: [], medium: [], low: [] };
            for (const a of alerts.data) {
              const sev = a.rule?.security_severity_level || a.rule?.severity || 'low';
              (bySeverity[sev] || bySeverity.low).push(a);
            }

            const lines = [
              '## 🔒 Weekly Security Report',
              `**Generated**: ${new Date().toISOString().split('T')[0]}`,
              '',
              '| Severity | Count |',
              '|----------|-------|',
              `| 🔴 Critical | ${bySeverity.critical.length} |`,
              `| 🟠 High     | ${bySeverity.high.length} |`,
              `| 🟡 Medium   | ${bySeverity.medium.length} |`,
              `| 🟢 Low      | ${bySeverity.low.length} |`,
              '',
            ];

            if (bySeverity.critical.length || bySeverity.high.length) {
              lines.push('### ⚠️ Critical / High Findings');
              for (const a of [...bySeverity.critical, ...bySeverity.high]) {
                lines.push(`- [${a.rule?.id}] **${a.rule?.description}** — \`${a.most_recent_instance?.location?.path}\` ([view](${a.html_url}))`);
              }
            } else {
              lines.push('✅ No critical or high severity findings.');
            }

            const body = lines.join('\n');
            core.setOutput('report', body);
            core.setOutput('has_critical', String(bySeverity.critical.length > 0));
            core.setOutput('has_high', String(bySeverity.high.length > 0));

      - name: Create or Update Security Report Issue
        uses: actions/github-script@v7
        with:
          script: |
            const report = `${{ steps.alerts.outputs.report }}`;
            const label = 'security-report';

            // Ensure label exists
            try {
              await github.rest.issues.createLabel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                name: label,
                color: 'e11d48',
              });
            } catch {}

            const issues = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: label,
              state: 'open',
            });

            if (issues.data.length > 0) {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issues.data[0].number,
                body: report,
              });
            } else {
              await github.rest.issues.create({
                owner: context.repo.owner,
                repo: context.repo.repo,
                title: '🔒 Security Report Dashboard',
                body: report,
                labels: [label],
              });
            }