chore/security : add code scan in ci #166
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: LRM Server CI | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| paths: | |
| - 'web/lrm/server/**' | |
| pull_request: | |
| branches: | |
| - '**' | |
| paths: | |
| - 'web/lrm/server/**' | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web/lrm/server | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 24.11 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run unit tests | |
| run: npm run test | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner - Dependencies | |
| uses: aquasecurity/trivy-action@0.24.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: 'web/lrm/server' | |
| format: 'sarif' | |
| output: 'trivy-dependencies.sarif' | |
| severity: 'LOW,MEDIUM,HIGH,CRITICAL' | |
| exit-code: '1' | |
| scanners: 'vuln' | |
| continue-on-error: false | |
| - name: Fix Dependencies SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('trivy-dependencies.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'trivy-dependencies.sarif' | |
| scan-path: 'web/lrm/server' | |
| - name: Check if dependencies SARIF file exists | |
| if: always() | |
| run: | | |
| if [ -f "trivy-dependencies.sarif" ]; then | |
| echo "✅ Dependencies SARIF file found" | |
| echo "File size: $(du -h trivy-dependencies.sarif)" | |
| echo "First few lines:" | |
| head -10 trivy-dependencies.sarif | |
| else | |
| echo "❌ Dependencies SARIF file not found" | |
| fi | |
| - name: Upload Trivy scan results to GitHub Security tab - Dependencies | |
| if: always() && hashFiles('trivy-dependencies.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-dependencies.sarif' | |
| category: 'trivy-lrm-server-dependencies' | |
| - name: Run Trivy vulnerability scanner - Dockerfile | |
| uses: aquasecurity/trivy-action@0.24.0 | |
| with: | |
| scan-type: 'config' | |
| scan-ref: 'web/lrm/server/Dockerfile' | |
| format: 'sarif' | |
| output: 'trivy-dockerfile.sarif' | |
| severity: 'LOW,MEDIUM,HIGH,CRITICAL' | |
| exit-code: '0' | |
| continue-on-error: true | |
| - name: Fix Dockerfile SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('trivy-dockerfile.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'trivy-dockerfile.sarif' | |
| scan-path: 'web/lrm/server' | |
| - name: Check if dockerfile SARIF file exists | |
| if: always() | |
| run: | | |
| if [ -f "trivy-dockerfile.sarif" ]; then | |
| echo "✅ Dockerfile SARIF file found" | |
| echo "File size: $(du -h trivy-dockerfile.sarif)" | |
| echo "First few lines:" | |
| head -10 trivy-dockerfile.sarif | |
| else | |
| echo "❌ Dockerfile SARIF file not found" | |
| fi | |
| - name: Upload Trivy scan results to GitHub Security tab - Dockerfile | |
| if: always() && hashFiles('trivy-dockerfile.sarif') != '' | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-dockerfile.sarif' | |
| category: 'trivy-lrm-server-dockerfile' | |
| - name: List files for debugging | |
| if: always() | |
| run: | | |
| echo "Files in current directory:" | |
| ls -la | |
| echo "Looking for SARIF files:" | |
| find . -name "*.sarif" -type f | |
| - name: Upload Trivy reports as artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: trivy-reports-lrm-server | |
| path: '*.sarif' | |
| retention-days: 7 |