chore/security : add code scan in ci #176
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: LRM Server CI | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| paths: | |
| - 'web/lrm/server/**' | |
| pull_request: | |
| branches: | |
| - '**' | |
| paths: | |
| - 'web/lrm/server/**' | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web/lrm/server | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 24.11 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run unit tests | |
| run: npm run test | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| name: Security Scanning | |
| defaults: | |
| run: | |
| working-directory: web/lrm/server | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v5 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.11 | |
| cache: 'npm' | |
| cache-dependency-path: 'web/lrm/server/package-lock.json' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run Semgrep (code scanning) | |
| run: | | |
| # Install Semgrep | |
| pip install semgrep | |
| # Exclude virtual environments, cache, and non-source directories | |
| semgrep --config auto --sarif --output semgrep.sarif \ | |
| --exclude='node_modules' \ | |
| --exclude='dist' \ | |
| --exclude='build' \ | |
| --exclude='coverage' \ | |
| --exclude='.git' \ | |
| --exclude='*.min.js' \ | |
| --exclude='*.bundle.js' | |
| - name: Fix Semgrep SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('web/lrm/server/semgrep.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'web/lrm/server/semgrep.sarif' | |
| scan-path: 'web/lrm/server' | |
| - name: Upload Semgrep results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: web/lrm/server/semgrep.sarif | |
| category: semgrep-lrm-server | |
| - name: Run Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| scan-type: fs | |
| scan-ref: web/lrm/server | |
| scanners: vuln,secret,config | |
| format: sarif | |
| output: web/lrm/server/trivy-filesystem.sarif | |
| ignore-unfixed: true | |
| exit-code: '0' | |
| - name: Run Trivy Dockerfile scan | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| scan-type: config | |
| scan-ref: web/lrm/server/Dockerfile | |
| scanners: vuln,config | |
| format: sarif | |
| output: web/lrm/server/trivy-dockerfile.sarif | |
| ignore-unfixed: true | |
| exit-code: '0' | |
| - name: Fix Trivy filesystem SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('web/lrm/server/trivy-filesystem.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'web/lrm/server/trivy-filesystem.sarif' | |
| scan-path: 'web/lrm/server' | |
| - name: Upload Trivy filesystem results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: web/lrm/server/trivy-filesystem.sarif | |
| category: trivy-lrm-server-filesystem | |
| - name: Fix Trivy Dockerfile SARIF file paths for GitHub Security tab | |
| if: always() && hashFiles('web/lrm/server/trivy-dockerfile.sarif') != '' | |
| uses: ./.github/actions/fix-trivy-sarif | |
| with: | |
| sarif-file: 'web/lrm/server/trivy-dockerfile.sarif' | |
| scan-path: 'web/lrm/server' | |
| - name: Upload Trivy Dockerfile results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: web/lrm/server/trivy-dockerfile.sarif | |
| category: trivy-lrm-server-dockerfile | |
| - name: Upload Security scan reports as artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-reports-lrm-server | |
| path: | | |
| web/lrm/server/semgrep.sarif | |
| web/lrm/server/trivy-filesystem.sarif | |
| web/lrm/server/trivy-dockerfile.sarif | |
| retention-days: 7 | |
| if-no-files-found: warn |