sast_scan.yaml

name: Codebase SAST Scan
on:
  workflow_call:
    inputs:
      fail_on_severity:
        description: 'Fail the scan if vulnerabilities of this severity or higher are found. Valid values: CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN, NONE'
        required: false
        type: string
        default: 'NONE'
      upload_results_to_ghas:
        description: 'Upload the scan results to GitHub Advanced Security'
        required: false
        type: boolean
        default: true
      upload_results_to_pr:
        description: 'Upload the scan results as a comment on the pull request'
        required: false
        type: boolean
        default: false

jobs:
  codebase-scan:
    name: Codebase Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
      pull-requests: write
      checks: write
    
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Cache vulnerability database
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .cache/trivy
          key: ${{ runner.os }}-trivy-db-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-trivy-db-

      - name: Perform SAST scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          trivy-config: '.github/trivy.yaml'
          output: 'trivy-results.sarif'
          version: 'v0.69.2' # https://github.com/aquasecurity/trivy-action/issues/512
        env:
          TRIVY_FAIL_ON_SEVERITY: ${{ inputs.fail_on_severity }}

      - name: Upload scan results to GitHub
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        if: ${{ inputs.upload_results_to_ghas }}
        with:
          sarif_file: 'trivy-results.sarif'
          category: 'trivy-sast'

      - name: Upload scan results to PR
        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
        if: ${{ inputs.upload_results_to_pr && github.event_name == 'pull_request' }}
        with: 
          header: '## SAST Scan Results'
          path: 'trivy-results.sarif'