chore/security : add code scan in ci #285
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: LRM Client CI | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| paths: | |
| - 'web/lrm/client/**' | |
| pull_request: | |
| branches: | |
| - '**' | |
| paths: | |
| - 'web/lrm/client/**' | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web/lrm/client | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 24.11 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run ESLint | |
| run: npm run lint:js | |
| - name: Run Stylelint | |
| run: npm run lint:css | |
| - name: Run Prettier check | |
| run: npx prettier --check "**/*.{js,ts,vue,css,scss}" | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| name: Security Scanning | |
| defaults: | |
| run: | |
| working-directory: web/lrm/client | |
| steps: | |
| # 1️⃣ Checkout repository | |
| - uses: actions/checkout@v5 | |
| # 2️⃣ Set up Node.js (needed for JavaScript project analysis) | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '19' | |
| cache: 'npm' | |
| cache-dependency-path: 'web/lrm/client/package-lock.json' | |
| # 3️⃣ Install dependencies for better dependency scanning | |
| - name: Install dependencies | |
| run: npm ci | |
| # 4️⃣ Semgrep scan (code scanning) | |
| - name: Run Semgrep | |
| run: | | |
| # Install Semgrep | |
| pip install semgrep | |
| # Exclude virtual environments, cache, and non-source directories | |
| semgrep --config auto --sarif --output semgrep.sarif \ | |
| --exclude='node_modules' \ | |
| --exclude='dist' \ | |
| --exclude='build' \ | |
| --exclude='.nuxt' \ | |
| --exclude='.git' \ | |
| --exclude='coverage' \ | |
| --exclude='*.min.js' \ | |
| --exclude='*.bundle.js' | |
| - name: Fix Semgrep SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('web/lrm/client/semgrep.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'web/lrm/client/semgrep.sarif' | |
| scan-path: 'web/lrm/client' | |
| - name: Upload Semgrep results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: web/lrm/client/semgrep.sarif | |
| category: semgrep-lrm-client | |
| # 5️⃣ Trivy scan (filesystem, Dockerfile, configs, secrets) | |
| - name: Run Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| scan-type: fs | |
| scan-ref: web/lrm/client | |
| scanners: vuln,secret,config | |
| format: sarif | |
| output: web/lrm/client/trivy-filesystem.sarif | |
| ignore-unfixed: true | |
| exit-code: '0' | |
| - name: Run Trivy Dockerfile scan | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| scan-type: config | |
| scan-ref: web/lrm/client/Dockerfile | |
| scanners: vuln,config | |
| format: sarif | |
| output: web/lrm/client/trivy-dockerfile.sarif | |
| ignore-unfixed: true | |
| exit-code: '0' | |
| - name: Fix Trivy filesystem SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('web/lrm/client/trivy-filesystem.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'web/lrm/client/trivy-filesystem.sarif' | |
| scan-path: 'web/lrm/client' | |
| - name: Upload Trivy filesystem results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: web/lrm/client/trivy-filesystem.sarif | |
| category: trivy-lrm-client-filesystem | |
| - name: Fix Trivy Dockerfile SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('web/lrm/client/trivy-dockerfile.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'web/lrm/client/trivy-dockerfile.sarif' | |
| scan-path: 'web/lrm/client' | |
| - name: Upload Trivy Dockerfile results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: web/lrm/client/trivy-dockerfile.sarif | |
| category: trivy-lrm-client-dockerfile | |
| # 6️⃣ Upload all security scan reports as a single artifact | |
| - name: Upload Security scan reports as artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-reports-lrm-client | |
| path: | | |
| web/lrm/client/semgrep.sarif | |
| web/lrm/client/trivy-filesystem.sarif | |
| web/lrm/client/trivy-dockerfile.sarif | |
| retention-days: 7 | |
| if-no-files-found: warn |