codeoracle/.github/workflows/security.yml at main · Sawmonabo/codeoracle · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: security

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Daily at 03:00 UTC — catches new CVEs in pinned deps
  - cron: 0 3 * * *

permissions:
  contents: read
  security-events: write  # for uploading SARIF to code-scanning

env:
  UV_PYTHON: '3.14'

jobs:
  gitleaks:
    name: gitleaks (secret scan, full history)
    runs-on: ubuntu-latest
    steps:
    - name: Checkout (full history)
      uses: actions/checkout@v6.0.3
      with:
        fetch-depth: 0

    - name: Run gitleaks
      uses: gitleaks/gitleaks-action@v3.0.0
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  semgrep:
    name: semgrep (custom SAST + OWASP top 10)
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep:1.166.0
    steps:
    - uses: actions/checkout@v6.0.3

    - name: Run custom rules
      run: |
        semgrep ci \
          --config=infra/security/semgrep/codeoracle-custom.yml \
          --sarif --output=semgrep-custom.sarif

    - name: Run OWASP rules
      run: |
        semgrep ci \
          --config=p/owasp-top-ten \
          --config=p/python \
          --config=p/secrets \
          --sarif --output=semgrep-owasp.sarif

    - name: Upload custom SARIF
      if: always()
      uses: github/codeql-action/upload-sarif@v4.36.2
      with:
        sarif_file: semgrep-custom.sarif
        category: semgrep-custom

    - name: Upload OWASP SARIF
      if: always()
      uses: github/codeql-action/upload-sarif@v4.36.2
      with:
        sarif_file: semgrep-owasp.sarif
        category: semgrep-owasp

  dependency-audit:
    name: dependency CVE audit (osv-scanner)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6.0.3

    - name: Install uv
      uses: astral-sh/setup-uv@v8.2.0
      with:
        version: 0.11.21

    - name: Sync deps
      run: uv sync --frozen

    - name: Install osv-scanner
      uses: actions/setup-go@v6.4.0
      with:
        go-version: 1.26.4
    - name: Install osv-scanner binary
      run: |
        go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.3.8
        echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"

    - name: osv-scanner
      run: osv-scanner --lockfile=uv.lock

  sbom:
    name: SBOM (cyclonedx-py)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6.0.3

    - name: Install uv
      uses: astral-sh/setup-uv@v8.2.0
      with:
        version: 0.11.21

    - name: Sync deps
      run: uv sync --frozen

    - name: Generate SBOM
      run: |
        uv run cyclonedx-py environment --output-format JSON \
          --output-file sbom.json
        uv run cyclonedx-py environment --output-format XML \
          --output-file sbom.xml

    - name: Upload SBOM
      uses: actions/upload-artifact@v7.0.1
      with:
        name: sbom
        path: |
          sbom.json
          sbom.xml
        retention-days: 90