Security #203
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| pull_request: | |
| branches: [dev, main] | |
| schedule: | |
| # Run security scans weekly on Mondays at 2 AM UTC | |
| - cron: '0 2 * * 1' | |
| jobs: | |
| secrets-scan: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # Fetch all history for secret scanning | |
| - name: Run gitleaks | |
| id: gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| continue-on-error: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} | |
| - name: Secret Scan Status | |
| if: steps.gitleaks.outcome == 'failure' | |
| run: | | |
| echo "::warning::Gitleaks could not complete (missing permission or license)." | |
| echo "::warning::Ensure the workflow token has pull request read access and set GITLEAKS_LICENSE if required." | |
| codeql-analysis: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: csharp | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - run: dotnet restore src/Maenifold.csproj | |
| - run: dotnet build src/Maenifold.csproj --configuration Release --no-restore | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| id: analyze-security | |
| continue-on-error: true | |
| - name: CodeQL Security Analysis Status | |
| if: steps.analyze-security.outcome == 'failure' | |
| run: | | |
| echo "::warning::CodeQL security analysis completed but SARIF upload failed." | |
| echo "::warning::This typically means repository-level code scanning is not enabled." | |
| echo "::warning::To fix this: Go to Settings → Security → Code security and analysis → Enable Code scanning." | |
| echo "::notice::The security analysis was performed successfully, only the upload to GitHub failed." | |
| dependency-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - name: Restore dependencies | |
| run: dotnet restore src/Maenifold.csproj | |
| - name: Check for known vulnerabilities | |
| run: dotnet list src/Maenifold.csproj package --vulnerable --include-transitive |