cli/.github/workflows/security.yml at main · Enkryptify/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: Security Scan

on:
    schedule:
        - cron: "0 8 * * 1" # Every Monday at 08:00 UTC
    workflow_dispatch:

jobs:
    dependency-audit:
        name: Dependency Audit
        runs-on: blacksmith-2vcpu-ubuntu-2404
        steps:
            - uses: actions/checkout@v6

            - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3
              with:
                  bun-version: "1.3.10"

            - uses: actions/cache@v4
              with:
                  path: ~/.bun/install/cache
                  key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
                  restore-keys: bun-${{ runner.os }}-

            - run: bun install --frozen-lockfile

            - name: Audit dependencies
              run: bun audit --audit-level=high

            - name: Generate SBOM
              run: |
                  tmpdir=$(mktemp -d)
                  npm exec --prefix "$tmpdir" --yes --package @cyclonedx/cyclonedx-npm -- cyclonedx-npm --output-file sbom.json

            - name: Upload SBOM
              uses: actions/upload-artifact@v4
              with:
                  name: sbom-weekly
                  path: sbom.json
                  retention-days: 90

    betterleaks-full:
        name: Full Secret Scan
        runs-on: blacksmith-2vcpu-ubuntu-2404
        steps:
            - uses: actions/checkout@v6
              with:
                  fetch-depth: 0

            - name: Install BetterLeaks
              run: |
                  set -euo pipefail
                  BETTERLEAKS_VERSION=$(curl -s https://api.github.com/repos/betterleaks/betterleaks/releases/latest | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/')
                  curl -sSfL "https://github.com/betterleaks/betterleaks/releases/download/v${BETTERLEAKS_VERSION}/betterleaks_${BETTERLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin betterleaks

            - name: Full history scan
              run: betterleaks git --report-format=sarif --report-path=betterleaks-results.sarif .

            - name: Upload SARIF results
              if: always()
              uses: actions/upload-artifact@v4
              with:
                  name: betterleaks-full-results
                  path: betterleaks-results.sarif
                  retention-days: 90

    license-check:
        name: License Compliance
        runs-on: blacksmith-2vcpu-ubuntu-2404
        steps:
            - uses: actions/checkout@v6

            - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3
              with:
                  bun-version: "1.3.10"

            - uses: actions/cache@v4
              with:
                  path: ~/.bun/install/cache
                  key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
                  restore-keys: bun-${{ runner.os }}-

            - run: bun install --frozen-lockfile

            - name: Check licenses
              run: bunx license-checker --production --failOn "AGPL-3.0-only;AGPL-3.0-or-later;SSPL-1.0"