ci: scope heavy checks to changed files #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning & Penetration Testing | ||
|
Check failure on line 1 in .github/workflows/security-scan.yml
|
||
| on: | ||
| push: | ||
| branches: [ main, develop ] | ||
| paths: | ||
| - '**.rs' | ||
| - '**.yaml' | ||
| - '**.yml' | ||
| - 'charts/**' | ||
| - 'Dockerfile*' | ||
| - 'Makefile' | ||
| pull_request: | ||
| branches: [ main ] | ||
| jobs: | ||
| cargo-audit: | ||
| name: Cargo Security Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Rust | ||
| uses: dtolnay/rust-toolchain@stable | ||
| - name: Cargo Audit | ||
| uses: actions-rs/audit-check@v1 | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| trivy-vuln-scan: | ||
| name: Trivy Vulnerability Scanner (Code/FS/Dep/Containers) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Run Trivy vulnerability scanner FS | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| scan-type: 'fs' | ||
| scan-ref: '.' | ||
| format: 'sarif' | ||
| output: 'trivy-fs-results.sarif' | ||
| severity: 'CRITICAL,HIGH' | ||
| - name: Run Trivy vulnerability scanner Cargo | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| scan-type: 'fs' | ||
| scan-ref: '.' | ||
| format: 'sarif' | ||
| output: 'trivy-cargo-results.sarif' | ||
| severity: 'CRITICAL,HIGH' | ||
| args: ['--scanners', 'vuln', '--vuln-type', 'library'] | ||
| - name: Upload Trivy scan results FS | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: trivy-fs-results.sarif | ||
| - name: Upload Trivy cargo results | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: trivy-cargo-results.sarif | ||
| docker-trivy: | ||
| name: Trivy Container Scan | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Build Docker image | ||
| run: docker build -t stellar-operator:scan . | ||
| - name: Run Trivy on Docker image | ||
| uses: aquasecurity/trivy-action@master | ||
| with: | ||
| image-ref: 'stellar-operator:scan' | ||
| format: 'sarif' | ||
| output: 'trivy-docker.sarif' | ||
| severity: 'CRITICAL,HIGH' | ||
| - name: Upload Trivy Docker scan | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: trivy-docker.sarif | ||
| iac-checkov: | ||
| name: IaC Security Scan (Helm/K8s manifests) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Checkov IaC scan | ||
| uses: bridgecrewio/checkov-action@v12 | ||
| with: | ||
| directory: charts/ | ||
| framework: kubernetes # Helm rendered as K8s | ||
| output_format: sarif | ||
| output_file_path: checkov-results.sarif | ||
| - name: Upload Checkov results | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: checkov-results.sarif | ||
| compliance-kube-bench: | ||
| name: Kubernetes Compliance (CIS Kube-bench) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Run kube-bench | ||
| run: | | ||
| curl -LO \"https://github.com/aquasecurity/kube-bench/releases/download/v0.6.0/kube-bench_${{ matrix.os }}_v0.6.0_linux_amd64.tar.gz\" | ||
| tar -xzf kube-bench_*.tar.gz | ||
| ./kube-bench --benchmark config/stellar-bench.yaml | ||
| env: | ||
| KUBECONFIG: /dev/null # Static analysis mode | ||
| pen-testing-k6: | ||
| name: Penetration Testing Scenarios (k6) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Setup k6 | ||
| uses: grafana/xk6-action@v2 | ||
| with: | ||
| version: 'v0.53.0' | ||
| - name: Run k6 penetration test scenarios | ||
| run: | | ||
| mkdir -p benchmarks/security/ | ||
| k6 run benchmarks/k6/security-pen-test.js | ||
| env: | ||
| K6_OUT: xk6-cloud # Optional cloud reporting | ||
| security-matrix: | ||
| name: Security Dashboard | ||
| runs-on: ubuntu-latest | ||
| needs: [cargo-audit, trivy-vuln-scan, docker-trivy, iac-checkov, compliance-kube-bench, pen-testing-k6] | ||
| if: always() | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Security Status Summary | ||
| run: | | ||
| echo \"## Security Scan Results\" >> $GITHUB_STEP_SUMMARY | ||
| echo \"| Job | Status |\" >> $GITHUB_STEP_SUMMARY | ||
| echo \"|-----|--------|\" >> $GITHUB_STEP_SUMMARY | ||
| for job in cargo-audit trivy-vuln-scan docker-trivy iac-checkov compliance-kube-bench pen-testing-k6; do | ||
| status=\"\${{ needs.$job.result }}\" | ||
| echo \"| $job | \$status |\" >> $GITHUB_STEP_SUMMARY | ||
| done | ||
