Merge pull request #91 from afonsoft/dependabot/github_actions/action… #130
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔒 Security Scan | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 2 * * 1" # Weekly on Monday at 2 AM UTC | |
| jobs: | |
| # CodeQL Analysis | |
| codeql: | |
| name: 🔍 CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["csharp"] | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v7.0.0 | |
| - name: 🔍 Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - name: 🔍 Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: 🔍 Perform Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| # Snyk Security Scan | |
| snyk: | |
| name: 🛡️ Snyk Security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v7.0.0 | |
| - name: 🗄️ Setup .NET | |
| uses: actions/setup-dotnet@v5.4.0 | |
| with: | |
| dotnet-version: "10.0.x" | |
| - name: 🔧 Restore Dependencies | |
| run: dotnet restore QRCoder.Core.sln --ignore-failed-sources | |
| - name: 🛡️ Install Snyk CLI | |
| run: | | |
| curl -s https://static.snyk.io/cli/latest/snyk-linux -o snyk | |
| chmod +x ./snyk | |
| sudo mv ./snyk /usr/local/bin/ | |
| - name: 🛡️ Run Snyk Security Scan | |
| run: | | |
| if [ -z "$SNYK_TOKEN" ]; then | |
| echo "⚠️ SNYK_TOKEN is not set or empty, skipping Snyk scan" | |
| exit 0 | |
| fi | |
| snyk test --severity-threshold=high --all-projects | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| # SonarQube Analysis | |
| sonarqube: | |
| name: 📊 SonarQube Analysis | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: 📦 Setup NuGet | |
| uses: NuGet/setup-nuget@v4 | |
| - name: 🗄️ Setup .NET | |
| uses: actions/setup-dotnet@v5.4.0 | |
| with: | |
| dotnet-version: "10.0.x" | |
| - name: ☕ Set up JDK 17 | |
| uses: actions/setup-java@v5 | |
| with: | |
| java-version: 17 | |
| distribution: "zulu" | |
| - name: 🔧 Clear NuGet cache | |
| run: dotnet nuget locals all --clear | |
| - name: 📦 Install SonarQube Tools | |
| run: dotnet tool install --global --ignore-failed-sources dotnet-sonarscanner | |
| - name: 📦 Install Coverlet Tools | |
| run: dotnet tool install --global --ignore-failed-sources coverlet.console | |
| - name: 🔧 Fix Permission | |
| run: chmod 777 sonar/ -R || true | |
| - name: 🔍 Prepare analysis on SonarQube | |
| run: | | |
| echo "🔍 Checking SonarQube configuration..." | |
| if [ -z "${{ secrets.SONNAR_TOKEN }}" ]; then | |
| echo "❌ SONNAR_TOKEN is not set or empty" | |
| echo "⚠️ Skipping SonarQube analysis" | |
| exit 0 | |
| fi | |
| echo "✅ SONNAR_TOKEN is configured" | |
| dotnet sonarscanner begin \ | |
| /o:"afonsoft" \ | |
| /k:"afonsoft_QRCoder.Core" \ | |
| /d:sonar.host.url="https://sonarcloud.io" \ | |
| /d:sonar.login="${{ secrets.SONNAR_TOKEN }}" \ | |
| /d:sonar.scm.provider=git \ | |
| /d:sonar.coverage.exclusions="**Test*.cs" | |
| - name: 🏗️ Build | |
| run: dotnet build QRCoder.Core.sln --configuration release | |
| - name: 🔍 Run Code Analysis | |
| run: | | |
| echo "🔍 Finalizing SonarQube analysis..." | |
| if [ -z "${{ secrets.SONNAR_TOKEN }}" ]; then | |
| echo "⚠️ SONNAR_TOKEN not configured, skipping analysis" | |
| exit 0 | |
| fi | |
| dotnet sonarscanner end /d:sonar.login="${{ secrets.SONNAR_TOKEN }}" | |
| # Security Summary | |
| security-summary: | |
| name: 📋 Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [codeql, snyk] | |
| if: always() | |
| steps: | |
| - name: 📋 Generate Security Report | |
| run: | | |
| echo "## 🔒 Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| Tool | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| 🔍 CodeQL | ${{ needs.codeql.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| 🛡️ Snyk | ${{ needs.snyk.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| 📊 SonarQube | ${{ contains(needs.*.result, 'skipped') && 'skipped' || 'N/A' }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.codeql.result }}" == "failure" || "${{ needs.snyk.result }}" == "failure" ]]; then | |
| echo "❌ **Security issues detected! Please review the scan results.**" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "✅ **All security scans passed successfully!**" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: 🚨 Security Alert | |
| if: needs.codeql.result == 'failure' || needs.snyk.result == 'failure' | |
| run: | | |
| echo "🚨 SECURITY ISSUES DETECTED!" | |
| echo "Please review the security scan results immediately." |