mirror of
https://github.com/coder/coder.git
synced 2026-06-04 21:48:22 +00:00
Jakub Domeracki
b8e09d09b0
Action taken In response to an ongoing incident: https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/ > We've not been compromised due to a combination of pinning [GitHub Actions by commit SHA](https://github.com/coder/coder/blob/c8e58575e0ee44fad37b5f2ffe1ef0f220c3cf23/.github/workflows/security.yaml#L149) coupled with a [dependabot cooldown period](https://github.com/coder/coder/pull/21079)
66 lines
1.8 KiB
YAML
66 lines
1.8 KiB
YAML
name: "security"
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
# Uncomment when testing.
|
|
# pull_request:
|
|
|
|
schedule:
|
|
# Run every 6 hours Monday-Friday!
|
|
- cron: "0 0/6 * * 1-5"
|
|
|
|
# Cancel in-progress runs for pull requests when developers push
|
|
# additional changes
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}-security
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
codeql:
|
|
permissions:
|
|
security-events: write
|
|
runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup Go
|
|
uses: ./.github/actions/setup-go
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
|
|
with:
|
|
languages: go, javascript
|
|
|
|
# Workaround to prevent CodeQL from building the dashboard.
|
|
- name: Remove Makefile
|
|
run: |
|
|
rm Makefile
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v3.29.5
|
|
|
|
- name: Send Slack notification on failure
|
|
if: ${{ failure() }}
|
|
run: |
|
|
msg="❌ CodeQL Failed\n\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
|
|
curl \
|
|
-qfsSL \
|
|
-X POST \
|
|
-H "Content-Type: application/json" \
|
|
--data "{\"content\": \"$msg\"}" \
|
|
"${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}"
|
|
|