diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b5865bdd..d7a89f2c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -1,49 +1,27 @@ -name: SecurityChecks +name: Securitychecks on: + workflow_dispatch: pull_request: {} push: branches: ["master"] + schedule: + - cron: '30 20 * * *' jobs: - semgrep: - name: Scan - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: returntocorp/semgrep-action@v1 - with: - publishToken: ${{ secrets.SEMGREP_APP_TOKEN }} - publishDeployment: 339 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + security-sast: + uses: razorpay/security-action/.github/workflows/semgrep.yml@master + secrets: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} - workflow_status: - runs-on: ubuntu-latest - name: Update Status Check - needs: [ semgrep ] + security-packagevulnerability: + uses: razorpay/security-action/.github/workflows/package_scan.yml@master + with: + PROGRAMMING_LANGUAGE: GO + secrets: + GIT_TOKEN: ${{ secrets.GIT_TOKEN }} + + security-statuscheck: + needs: [ security-sast ] if: always() - env: - githubCommit: ${{ github.event.pull_request.head.sha }} - steps: - - name: Set github commit id - run: | - if [ "${{ github.event_name }}" = "push" ]; then - echo "githubCommit=${{ github.sha }}" >> $GITHUB_ENV - fi - exit 0 - - name: Failed - id: failed - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') - run: | - echo 'Failing the workflow for github security status check.' - curl -X POST -H "Content-Type: application/json" -H "Authorization: token ${{ github.token }}" \ - -d '{ "state" : "failure" , "context" : "github/security-status-check" , "description" : "github/security-status-check", "target_url" : "https://github.com/${{ github.repository }}" }' \ - https://api.github.com/repos/${{ github.repository }}/statuses/${{ env.githubCommit }} - exit 1 - - name: Success - if: steps.failed.conclusion == 'skipped' - run: | - echo 'Status check has passed!' - curl -X POST -H "Content-Type: application/json" -H "Authorization: token ${{ github.token }}" \ - -d '{ "state" : "success" , "context" : "github/security-status-check" , "description" : "github/security-status-check", "target_url" : "https://github.com/${{ github.repository }}" }' \ - https://api.github.com/repos/${{ github.repository }}/statuses/${{ env.githubCommit }} - exit 0 + uses: razorpay/security-action/.github/workflows/status_check.yml@master + with: + WORKFLOW_RESULT: ${{ needs.security-sast.result == 'success' && needs.security-sast.result != 'cancelled' || 'false' }}