Skip to content

Commit cbda8e5

Browse files
mhuckapavoljuhas
mhucka
and
pavoljuhas
authored
Fix #406: add missing security scan workflow (#425)
Co-authored-by: Pavol Juhas <[email protected]>
1 parent 9b68290 commit cbda8e5

File tree

3 files changed

+262
-72
lines changed

3 files changed

+262
-72
lines changed

‎.github/workflows/ossf-scorecard.yaml‎

Lines changed: 0 additions & 72 deletions
This file was deleted.

‎.github/workflows/osv-scanner.yaml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Summary: run the Open Source Vulnerabilities scanner on PRs & weekly.
16+
#
17+
# The OSV scanner is a dependency vulnerability scanner that identifies known
18+
# vulnerabilities in a project's dependencies. It supports C/C++, Python, Java,
19+
# JavaScript, and others. The findings are reported in the repo's code-scanning
20+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
21+
# For more OSV scanner examples and options, including how to ignore specific
22+
# vulnerabilities, see https://google.github.io/osv-scanner/github-action/.
23+
24+
name: OSV vulnerabilities scan
25+
run-name: Run open-source vulnerabilities (OSV) scanner
26+
27+
on:
28+
schedule:
29+
# Run weekly on Saturdays.
30+
- cron: '30 10 * * 6'
31+
32+
pull_request:
33+
types: [opened, synchronize]
34+
branches:
35+
- main
36+
- master
37+
38+
# Support merge queues.
39+
merge_group:
40+
types:
41+
- checks_requested
42+
43+
# Allow manual invocation.
44+
workflow_dispatch:
45+
inputs:
46+
debug:
47+
description: 'Run with debugging options'
48+
type: boolean
49+
default: true
50+
51+
# Declare default workflow permissions as read only.
52+
permissions: read-all
53+
54+
concurrency:
55+
# Cancel any previously-started but still active runs on the same branch.
56+
cancel-in-progress: true
57+
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
58+
59+
jobs:
60+
osv-scan:
61+
if: github.repository_owner == 'quantumlib'
62+
name: OSV scanner
63+
runs-on: ubuntu-24.04
64+
timeout-minutes: 15
65+
permissions:
66+
# Needed to upload the results to code-scanning dashboard:
67+
security-events: write
68+
env:
69+
# Setting Bash SHELLOPTS here takes effect for all shell commands below.
70+
SHELLOPTS: ${{inputs.debug && 'xtrace' || '' }}
71+
steps:
72+
- name: Check out a copy of the git repository
73+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
74+
with:
75+
fetch-depth: 0
76+
77+
- name: Check out the target branch
78+
run: |
79+
git checkout ${{github.base_ref || github.ref_name}}
80+
git submodule update --recursive
81+
82+
- name: Run OSV scanner on existing code
83+
# yamllint disable rule:line-length
84+
uses: google/osv-scanner-action/osv-scanner-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
85+
continue-on-error: true
86+
with:
87+
scan-args: |-
88+
--include-git-root
89+
--format=json
90+
--output=old-results.json
91+
--recursive
92+
./
93+
94+
- name: Check out current branch
95+
# Use -f in case any changes were made by osv-scanner.
96+
run: |
97+
git checkout -f "$GITHUB_SHA"
98+
git submodule update --recursive
99+
100+
- name: Run OSV scanner on new code
101+
# yamllint disable rule:line-length
102+
uses: google/osv-scanner-action/osv-scanner-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
103+
continue-on-error: true
104+
with:
105+
scan-args: |-
106+
--include-git-root
107+
--format=json
108+
--output=new-results.json
109+
--recursive
110+
./
111+
112+
- name: Run the OSV scanner reporter for the job summary page
113+
# yamllint disable rule:line-length
114+
uses: google/osv-scanner-action/osv-reporter-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
115+
with:
116+
scan-args: |-
117+
--output=markdown:output.md
118+
--old=old-results.json
119+
--new=new-results.json
120+
--fail-on-vuln=false
121+
122+
- name: Write the results to the job summary page
123+
run: cat output.md >> "$GITHUB_STEP_SUMMARY"
124+
125+
- name: Run the OSV scanner reporter for the code-scanning dashboard
126+
# yamllint disable rule:line-length
127+
uses: google/osv-scanner-action/osv-reporter-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
128+
with:
129+
scan-args: |-
130+
--output=osv-results.sarif
131+
--old=old-results.json
132+
--new=new-results.json
133+
--gh-annotations=true
134+
--fail-on-vuln=true
135+
136+
- name: Upload results to the repository's code-scanning results dashboard
137+
id: upload_artifact
138+
# yamllint disable rule:line-length
139+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
140+
with:
141+
sarif_file: osv-results.sarif
142+
143+
- if: github.event.inputs.debug == true
144+
name: Upload results as artifacts to the workflow Summary page
145+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
146+
with:
147+
name: SARIF file
148+
path: osv-results.sarif
149+
retention-days: 5
150+
151+
- name: Error troubleshooter
152+
if: ${{always() && steps.upload_artifact.outcome == 'failure'}}
153+
run: echo '::error::Artifact upload failed. Check the workflow logs.'

‎.github/workflows/scorecard-scanner.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Summary: run the OSSF Scorecard scanner on PRs and every night.
16+
#
17+
# Scorecard (https://github.com/ossf/scorecard) is a repository-scanning tool
18+
# that evaluates a project's security practices. Its use is suggested by
19+
# Google's GitHub team. Scorecard's findings are reported in a repo's scanning
20+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
21+
22+
name: Scorecard analysis
23+
run-name: Run Scorecard scanner for security best practices
24+
25+
on:
26+
schedule:
27+
# Run weekly on Saturdays.
28+
- cron: '30 9 * * 6'
29+
30+
pull_request:
31+
types: [opened, synchronize]
32+
branches:
33+
- main
34+
- master
35+
36+
# Support merge queues.
37+
merge_group:
38+
types:
39+
- checks_requested
40+
41+
# Allow manual invocation.
42+
workflow_dispatch:
43+
inputs:
44+
debug:
45+
description: 'Run with debugging options'
46+
type: boolean
47+
default: true
48+
49+
# Declare default workflow permissions as read only.
50+
permissions: read-all
51+
52+
concurrency:
53+
# Cancel any previously-started but still active runs on the same branch.
54+
cancel-in-progress: true
55+
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
56+
57+
jobs:
58+
run-scorecard:
59+
if: github.repository_owner == 'quantumlib'
60+
name: Scorecard analyzer
61+
runs-on: ubuntu-24.04
62+
permissions:
63+
security-events: write
64+
id-token: write
65+
timeout-minutes: 15
66+
steps:
67+
- name: Check out a copy of the git repository
68+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
69+
with:
70+
persist-credentials: false
71+
72+
- name: Run Scorecard analysis
73+
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
74+
with:
75+
# Save the results
76+
results_file: scorecard-results.sarif
77+
results_format: sarif
78+
# See https://github.com/ossf/scorecard-action#publishing-results.
79+
publish_results: true
80+
81+
- name: Upload results to code-scanning dashboard
82+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
83+
with:
84+
sarif_file: scorecard-results.sarif
85+
86+
- if: github.event.inputs.debug == true
87+
name: Upload results as artifacts to the workflow Summary page
88+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
89+
with:
90+
name: Scorecard SARIF file
91+
path: scorecard-results.sarif
92+
retention-days: 5
93+
94+
# Scorecard currently (ver. 2.4.x) doesn't allow submissions from jobs having
95+
# steps that use "run:". To print to the summary, we need to use another job.
96+
write-summary:
97+
name: Scorecard results
98+
needs: run-scorecard
99+
runs-on: ubuntu-24.04
100+
timeout-minutes: 5
101+
steps:
102+
- name: Write the Scorecard report page link to the workflow summary
103+
run: |
104+
repo="${{github.repository}}"
105+
url="https://scorecard.dev/viewer/?uri=github.com/${repo}"
106+
{
107+
echo -n "The results are available on the OpenSSF Scorecard "
108+
echo "[report page for ${{github.repository}}]($url)."
109+
} >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)