chore/security : refacto security-scan ci to use matrix

Author: issam71100

.github/workflows/security-scan.yml

@@ -47,103 +47,106 @@ on:
         default: false
 
 jobs:
-  security-scan:
+  dependency-scan:
     runs-on: ubuntu-latest
-    name: Security Scanning
+    name: Dependency Vulnerability Scanning
+    if: inputs.project-type == 'python' && inputs.dependency-scan
     defaults:
       run:
         working-directory: ${{ inputs.working-directory }}
-    env:
-      SEMGREP_EXCLUDES: "--exclude='.git' --exclude='node_modules' --exclude='dist' --exclude='build' --exclude='coverage' --exclude='__pycache__' --exclude='.venv' --exclude='.cache' --exclude='.pytest_cache' --exclude='.tox' --exclude='.mypy_cache' --exclude='uv.lock' --exclude='*.pyc' --exclude='*.min.js' --exclude='*.bundle.js' --exclude='.gradle' --exclude='gradle/wrapper' --exclude='*.class' --exclude='*.jar'"
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
 
-      # Run dependency vulnerability scans
       - name: Install and run Python dependency scanner
-        if: inputs.project-type == 'python' && inputs.dependency-scan
         run: |
           pip install uv-secure
           uv-secure ${{ inputs.working-directory }}/uv.lock --format json > ${{ inputs.working-directory }}/uv-secure.json || true
 
-      # Run Semgrep code scanning
-      - name: Run Semgrep
+  security-scan:
+    runs-on: ubuntu-latest
+    name: Security Scanning
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    strategy:
+      fail-fast: false
+      matrix:
+        scan-config:
+          - name: semgrep
+            tool: semgrep
+            output-file: semgrep.sarif
+            category: semgrep
+            condition: true
+          - name: trivy-filesystem
+            tool: trivy
+            scan-type: fs
+            scan-ref: ${{ inputs.working-directory }}
+            scanners: vuln,secret,config
+            output-file: trivy-filesystem.sarif
+            category: trivy-filesystem
+            condition: true
+          - name: trivy-dockerfile
+            tool: trivy
+            scan-type: config
+            scan-ref: ${{ inputs.working-directory }}/Dockerfile
+            scanners: vuln,config
+            output-file: trivy-dockerfile.sarif
+            category: trivy-dockerfile
+            condition: ${{ inputs.scan-dockerfile }}
+
+    env:
+      SEMGREP_EXCLUDES: "--exclude='.git' --exclude='node_modules' --exclude='dist' --exclude='build' --exclude='coverage' --exclude='__pycache__' --exclude='.venv' --exclude='.cache' --exclude='.pytest_cache' --exclude='.tox' --exclude='.mypy_cache' --exclude='uv.lock' --exclude='*.pyc' --exclude='*.min.js' --exclude='*.bundle.js' --exclude='.gradle' --exclude='gradle/wrapper' --exclude='*.class' --exclude='*.jar'"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Run Semgrep scan
+        if: matrix.scan-config.tool == 'semgrep' && matrix.scan-config.condition
         run: |
           pip install semgrep
-          semgrep --config auto --sarif --output semgrep.sarif \
+          semgrep --config auto --sarif --output ${{ matrix.scan-config.output-file }} \
             $SEMGREP_EXCLUDES \
             ${{ inputs.semgrep-excludes }}
 
-      # Fix and upload Semgrep results
-      - name: Fix Semgrep SARIF file paths for GitHub Security tab
-        if: always() && hashFiles(format('{0}/semgrep.sarif', inputs.working-directory)) != ''
-        uses: ./.github/actions/fix-trivy-sarif
-        with:
-          sarif-file: '${{ inputs.working-directory }}/semgrep.sarif'
-          scan-path: '${{ inputs.working-directory }}'
-
-      - name: Upload Semgrep results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: ${{ inputs.working-directory }}/semgrep.sarif
-          category: semgrep-${{ inputs.component-name }}
-
-      # Run Trivy filesystem scan
-      - name: Run Trivy filesystem scan
+      - name: Run Trivy scan
+        if: matrix.scan-config.tool == 'trivy' && matrix.scan-config.condition
         uses: aquasecurity/trivy-action@0.33.1
         with:
-          scan-type: fs
-          scan-ref: ${{ inputs.working-directory }}
-          scanners: vuln,secret,config
+          scan-type: ${{ matrix.scan-config.scan-type }}
+          scan-ref: ${{ matrix.scan-config.scan-ref }}
+          scanners: ${{ matrix.scan-config.scanners }}
           format: sarif
-          output: ${{ inputs.working-directory }}/trivy-filesystem.sarif
+          output: ${{ inputs.working-directory }}/${{ matrix.scan-config.output-file }}
           ignore-unfixed: true
           exit-code: '0'
 
-      - name: Fix Trivy filesystem SARIF file paths for GitHub Security tab
-        if: always() && hashFiles(format('{0}/trivy-filesystem.sarif', inputs.working-directory)) != ''
+      - name: Fix SARIF file paths for GitHub Security tab
+        if: matrix.scan-config.condition && always() && hashFiles(format('{0}/{1}', inputs.working-directory, matrix.scan-config.output-file)) != ''
         uses: ./.github/actions/fix-trivy-sarif
         with:
-          sarif-file: '${{ inputs.working-directory }}/trivy-filesystem.sarif'
+          sarif-file: '${{ inputs.working-directory }}/${{ matrix.scan-config.output-file }}'
           scan-path: '${{ inputs.working-directory }}'
 
-      - name: Upload Trivy filesystem results to GitHub Security tab
+      - name: Upload ${{ matrix.scan-config.name }} results to GitHub Security tab
+        if: matrix.scan-config.condition
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: ${{ inputs.working-directory }}/trivy-filesystem.sarif
-          category: trivy-${{ inputs.component-name }}-filesystem
-
-      # Run Trivy Dockerfile scan (optional)
-      - name: Run Trivy Dockerfile scan
-        if: inputs.scan-dockerfile
-        uses: aquasecurity/trivy-action@0.33.1
-        with:
-          scan-type: config
-          scan-ref: ${{ inputs.working-directory }}/Dockerfile
-          scanners: vuln,config
-          format: sarif
-          output: ${{ inputs.working-directory }}/trivy-dockerfile.sarif
-          ignore-unfixed: true
-          exit-code: '0'
+          sarif_file: ${{ inputs.working-directory }}/${{ matrix.scan-config.output-file }}
+          category: ${{ matrix.scan-config.category }}-${{ inputs.component-name }}
 
-      - name: Fix Trivy Dockerfile SARIF file paths for GitHub Security tab
-        if: inputs.scan-dockerfile && always() && hashFiles(format('{0}/trivy-dockerfile.sarif', inputs.working-directory)) != ''
-        uses: ./.github/actions/fix-trivy-sarif
-        with:
-          sarif-file: '${{ inputs.working-directory }}/trivy-dockerfile.sarif'
-          scan-path: '${{ inputs.working-directory }}'
-
-      - name: Upload Trivy Dockerfile results to GitHub Security tab
-        if: inputs.scan-dockerfile
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: ${{ inputs.working-directory }}/trivy-dockerfile.sarif
-          category: trivy-${{ inputs.component-name }}-dockerfile
+  upload-artifacts:
+    runs-on: ubuntu-latest
+    name: Upload Security Artifacts
+    needs: [dependency-scan, security-scan]
+    if: always()
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
 
       # Upload all security reports as artifacts
       - name: Upload Security scan reports as artifact
-        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: security-reports-${{ inputs.component-name }}