security #116
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "security" | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| on: | |
| workflow_dispatch: | |
| # Uncomment when testing. | |
| # pull_request: | |
| schedule: | |
| # Run every 6 hours Monday-Friday! | |
| - cron: "0 0/6 * * 1-5" | |
| # Cancel in-progress runs for pull requests when developers push | |
| # additional changes | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-security | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| codeql: | |
| runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: ./.github/actions/setup-go | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: go, javascript | |
| # Workaround to prevent CodeQL from building the dashboard. | |
| - name: Remove Makefile | |
| run: | | |
| rm Makefile | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| - name: Send Slack notification on failure | |
| if: ${{ failure() }} | |
| run: | | |
| msg="❌ CodeQL Failed\n\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| curl \ | |
| -qfsSL \ | |
| -X POST \ | |
| -H "Content-Type: application/json" \ | |
| --data "{\"content\": \"$msg\"}" \ | |
| "${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}" | |
| trivy: | |
| runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: ./.github/actions/setup-go | |
| - name: Setup Node | |
| uses: ./.github/actions/setup-node | |
| - name: Setup sqlc | |
| uses: ./.github/actions/setup-sqlc | |
| - name: Install yq | |
| run: go run github.com/mikefarah/yq/[email protected] | |
| - name: Install mockgen | |
| run: go install go.uber.org/mock/[email protected] | |
| - name: Install protoc-gen-go | |
| run: go install google.golang.org/protobuf/cmd/[email protected] | |
| - name: Install protoc-gen-go-drpc | |
| run: go install storj.io/drpc/cmd/[email protected] | |
| - name: Install Protoc | |
| run: | | |
| # protoc must be in lockstep with our dogfood Dockerfile or the | |
| # version in the comments will differ. This is also defined in | |
| # ci.yaml. | |
| set -x | |
| cd dogfood | |
| DOCKER_BUILDKIT=1 docker build . --target proto -t protoc | |
| protoc_path=/usr/local/bin/protoc | |
| docker run --rm --entrypoint cat protoc /tmp/bin/protoc > $protoc_path | |
| chmod +x $protoc_path | |
| protoc --version | |
| - name: Build Coder linux amd64 Docker image | |
| id: build | |
| run: | | |
| set -euo pipefail | |
| version="$(./scripts/version.sh)" | |
| image_job="build/coder_${version}_linux_amd64.tag" | |
| # This environment variable force make to not build packages and | |
| # archives (which the Docker image depends on due to technical reasons | |
| # related to concurrent FS writes). | |
| export DOCKER_IMAGE_NO_PREREQUISITES=true | |
| # This environment variables forces scripts/build_docker.sh to build | |
| # the base image tag locally instead of using the cached version from | |
| # the registry. | |
| export CODER_IMAGE_BUILD_BASE_TAG="$(CODER_IMAGE_BASE=coder-base ./scripts/image_tag.sh --version "$version")" | |
| make -j "$image_job" | |
| echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 | |
| with: | |
| image-ref: ${{ steps.build.outputs.image }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| category: "Trivy" | |
| - name: Upload Trivy scan results as an artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: trivy | |
| path: trivy-results.sarif | |
| retention-days: 7 | |
| # Prisma cloud scan runs last because it fails the entire job if it | |
| # detects vulnerabilities. :| | |
| - name: Run Prisma Cloud image scan | |
| uses: PaloAltoNetworks/prisma-cloud-scan@v1 | |
| with: | |
| pcc_console_url: ${{ secrets.PRISMA_CLOUD_URL }} | |
| pcc_user: ${{ secrets.PRISMA_CLOUD_ACCESS_KEY }} | |
| pcc_pass: ${{ secrets.PRISMA_CLOUD_SECRET_KEY }} | |
| image_name: ${{ steps.build.outputs.image }} | |
| - name: Send Slack notification on failure | |
| if: ${{ failure() }} | |
| run: | | |
| msg="❌ Trivy Failed\n\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| curl \ | |
| -qfsSL \ | |
| -X POST \ | |
| -H "Content-Type: application/json" \ | |
| --data "{\"content\": \"$msg\"}" \ | |
| "${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}" |