Merge pull request #417 from TykTechnologies/add-path-based-scanner

[TT-16670] added path base scanner

Author: olamilekan000

.github/workflows/nightly-security-scan.yml

@@ -0,0 +1,58 @@
+name: Nightly Security Scan
+
+on:
+  schedule:
+    - cron: '30 0 * * *'
+  workflow_dispatch:
+
+jobs:
+  osv-scan:
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+      checks: write
+      statuses: write
+    uses: TykTechnologies/github-actions/.github/workflows/osv-path-scan.yml@78124512432a6f63372529cecbbbf58bf0411fa5
+    with:
+      image_name: "TykTechnologies/tyk-ui:${{ github.ref_name }}"
+      scan_args: "--format json --output osv-results.json --lockfile package-lock.json"
+
+  s1-scan:
+    name: SentinelOne CNS Scan
+    uses: TykTechnologies/github-actions/.github/workflows/s1-cns-scan.yml@78124512432a6f63372529cecbbbf58bf0411fa5 # main
+    permissions:
+      contents: read
+    with:
+      iac_enabled: false
+      tag: service:vulnscan
+      scope_type: ACCOUNT
+    secrets:
+      S1_API_TOKEN: ${{ secrets.S1_API_TOKEN }}
+      CONSOLE_URL: ${{ secrets.S1_CONSOLE_URL }}
+      SCOPE_ID: ${{ secrets.S1_SCOPE_ID }}
+
+  notify-complete:
+    name: Notify Slack on completion
+    runs-on: ubuntu-latest
+    needs: [osv-scan, s1-scan]
+    if: always() && needs.osv-scan.result != 'cancelled' && needs.osv-scan.result != 'skipped'
+    steps:
+      - name: Post to Slack
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          payload: |
+            {
+              "channel": "${{ secrets.CVE_SLACK_CHANNEL }}",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "*Nightly Path-Based CVE Scan: ${{ github.repository }}*\n${{ needs.osv-scan.outputs.slack_summary }}\n<${{ needs.osv-scan.outputs.check_run_url }}|Full CVE Report>"
+                  }
+                }
+              ]
+            }