|
|
|
@@ -26,18 +26,14 @@ on:
|
|
|
|
|
pull_request: {}
|
|
|
|
|
schedule:
|
|
|
|
|
- cron: "17 2 * * *"
|
|
|
|
|
workflow_dispatch: {}
|
|
|
|
|
permissions: { contents: read }
|
|
|
|
|
# N6 (server-config ci/jobbstorm-2026-11-10 §4): en ny commit på samma PR/gren avbryter den inaktuella körningen.
|
|
|
|
|
concurrency:
|
|
|
|
|
group: ${{ gitea.workflow }}-${{ gitea.ref }}
|
|
|
|
|
group: security-${{ github.ref }}
|
|
|
|
|
cancel-in-progress: true
|
|
|
|
|
|
|
|
|
|
jobs:
|
|
|
|
|
scan:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
# Övre gräns: ett scannerjobb får aldrig äta en delad runner-värd.
|
|
|
|
|
timeout-minutes: 60
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
|
with: { fetch-depth: 0 }
|
|
|
|
@@ -65,8 +61,8 @@ jobs:
|
|
|
|
|
- name: gitleaks secret scan
|
|
|
|
|
run: |
|
|
|
|
|
set +e
|
|
|
|
|
docker run --rm --cpus 2 --memory 4g -v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
zricethezav/gitleaks:v8.30.1 detect --no-git --source /repo --no-banner --redact --exit-code 1 > /tmp/scan.log 2>&1
|
|
|
|
|
docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
zricethezav/gitleaks:v8.30.1 detect --no-git --source /repo --no-banner --exit-code 1 > /tmp/scan.log 2>&1
|
|
|
|
|
rc=$?
|
|
|
|
|
set -e
|
|
|
|
|
tail -n 120 /tmp/scan.log
|
|
|
|
@@ -74,88 +70,23 @@ jobs:
|
|
|
|
|
if [ $rc -eq 1 ]; then echo "::error::gitleaks secret scan hittade fynd"; exit 1; fi
|
|
|
|
|
echo "::warning::gitleaks secret scan kunde inte köras (rc=$rc) - verktygsfel, inte fynd"; exit 0
|
|
|
|
|
|
|
|
|
|
# gitleaks over just de commits som PR:en eller pushen inför. Blockerar på
|
|
|
|
|
# hemligheter som introduceras i intervallet, även om de raderas senare i
|
|
|
|
|
# samma PR (de finns kvar i historiken efter merge). Git-läget med
|
|
|
|
|
# --log-opts skannar bara tillagda rader, så en PR som RADERAR en gammal
|
|
|
|
|
# hemlighet fälls inte, och .gitleaks.toml/.gitleaksignore i repot gäller.
|
|
|
|
|
# Fullhistoriken körs bara nattligt/manuellt (nästa steg): en full
|
|
|
|
|
# `git log -p --all` per PR tog timmar och sänkte runner-värden
|
|
|
|
|
# (server10, 2026-11-11).
|
|
|
|
|
- name: gitleaks commit range
|
|
|
|
|
if: github.event_name == 'pull_request' || github.event_name == 'push'
|
|
|
|
|
timeout-minutes: 15
|
|
|
|
|
env:
|
|
|
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
|
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
|
|
|
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
|
|
|
BEFORE_SHA: ${{ github.event.before }}
|
|
|
|
|
run: |
|
|
|
|
|
set -eu
|
|
|
|
|
test -d .git || { echo "::error::ingen .git i $PWD"; exit 1; }
|
|
|
|
|
head="${PR_HEAD_SHA:-$GITHUB_SHA}"
|
|
|
|
|
base=""
|
|
|
|
|
if [ "$EVENT_NAME" = "pull_request" ] && [ -n "${BASE_SHA:-}" ]; then
|
|
|
|
|
base=$(git merge-base "$BASE_SHA" "$head" 2>/dev/null || echo "$BASE_SHA")
|
|
|
|
|
elif [ -n "${BEFORE_SHA:-}" ] && [ "$BEFORE_SHA" != "0000000000000000000000000000000000000000" ] \
|
|
|
|
|
&& git cat-file -e "${BEFORE_SHA}^{commit}" 2>/dev/null; then
|
|
|
|
|
base="$BEFORE_SHA"
|
|
|
|
|
fi
|
|
|
|
|
MAX=500
|
|
|
|
|
if [ -n "$base" ]; then
|
|
|
|
|
count=$(git rev-list --count "$base..$head")
|
|
|
|
|
echo "intervall $base..$head: $count commits"
|
|
|
|
|
if [ "$count" -eq 0 ]; then echo "inga nya commits i intervallet"; exit 0; fi
|
|
|
|
|
if [ "$count" -gt "$MAX" ]; then
|
|
|
|
|
echo "::warning::intervallet har $count commits; skannar de $MAX senaste. Resten täcks av den nattliga fullhistorikskanningen."
|
|
|
|
|
fi
|
|
|
|
|
logopts="-n $MAX $base..$head"
|
|
|
|
|
else
|
|
|
|
|
echo "::notice::inget jämförbart föregående läge (ny gren eller omskriven historik); skannar head-commiten. Fullhistoriken täcks nattligt."
|
|
|
|
|
logopts="-n 1 $head"
|
|
|
|
|
fi
|
|
|
|
|
name="siax-gitleaks-range-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
|
|
|
|
|
set +e
|
|
|
|
|
timeout --signal=TERM 12m docker run --rm --name "$name" --cpus 2 --memory 4g \
|
|
|
|
|
-v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
-e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory -e GIT_CONFIG_VALUE_0='*' \
|
|
|
|
|
zricethezav/gitleaks:v8.30.1 detect --source /repo --log-opts="$logopts" \
|
|
|
|
|
--no-banner --redact --exit-code 1 > /tmp/scan.log 2>&1
|
|
|
|
|
rc=$?
|
|
|
|
|
set -e
|
|
|
|
|
docker kill "$name" >/dev/null 2>&1 || true
|
|
|
|
|
tail -n 120 /tmp/scan.log
|
|
|
|
|
if [ $rc -eq 0 ]; then echo "gitleaks commit range ren"; exit 0; fi
|
|
|
|
|
if [ $rc -eq 1 ]; then echo "::error::gitleaks commit range hittade fynd i införda commits"; exit 1; fi
|
|
|
|
|
if [ $rc -eq 124 ]; then echo "::error::gitleaks commit range nådde tidsgränsen - intervallet är EJ skannat"; exit 1; fi
|
|
|
|
|
echo "::warning::gitleaks commit range kunde inte köras (rc=$rc) - verktygsfel, inte fynd"; exit 0
|
|
|
|
|
|
|
|
|
|
# Hela historiken scannas informativt, bara nattligt eller manuellt och
|
|
|
|
|
# med tidsbudget. Gamla hemligheter i tidigare commits kräver
|
|
|
|
|
# historikomskrivning och blockerar därför inte bygget.
|
|
|
|
|
# Historiken scannas informativt. Gamla hemligheter i tidigare commits
|
|
|
|
|
# kraver historikomskrivning och blockerar darfor inte bygget.
|
|
|
|
|
- name: gitleaks history informational
|
|
|
|
|
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
|
|
|
|
|
timeout-minutes: 45
|
|
|
|
|
continue-on-error: true # ci2-allow-swallowed-failure: historik-gitleaks informativt per kanonisk security.yml
|
|
|
|
|
continue-on-error: true
|
|
|
|
|
run: |
|
|
|
|
|
name="siax-gitleaks-history-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
|
|
|
|
|
rc=0
|
|
|
|
|
timeout --signal=TERM 40m docker run --rm --name "$name" --cpus 2 --memory 6g \
|
|
|
|
|
-v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
-e GIT_CONFIG_COUNT=1 -e GIT_CONFIG_KEY_0=safe.directory \
|
|
|
|
|
-e GIT_CONFIG_VALUE_0='*' \
|
|
|
|
|
zricethezav/gitleaks:v8.30.1 detect --source /repo --no-banner --redact --exit-code 1 || rc=$?
|
|
|
|
|
docker kill "$name" >/dev/null 2>&1 || true
|
|
|
|
|
if [ "$rc" -eq 124 ]; then echo "::warning::fullhistorikskanningen nådde tidsbudgeten (40 min) - historiken är EJ fullständigt skannad"; fi
|
|
|
|
|
if [ "$rc" -ne 0 ]; then echo "::notice::historiska träffar eller avbrott loggas informativt (rc=$rc)"; fi
|
|
|
|
|
zricethezav/gitleaks:v8.30.1 detect --source /repo --no-banner --exit-code 1 \
|
|
|
|
|
|| echo "::notice::historiska traffar loggas informativt"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Trivy filsystem, blockerar pa HIGH och CRITICAL sarbarheter och hemligheter (SUP-*)
|
|
|
|
|
# Trivy filsystem, blockerar pa HIGH och CRITICAL (SUP-*)
|
|
|
|
|
- name: Trivy filesystem scan
|
|
|
|
|
run: |
|
|
|
|
|
set +e
|
|
|
|
|
docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
aquasec/trivy:0.76.2 fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --no-progress /repo > /tmp/scan.log 2>&1
|
|
|
|
|
aquasec/trivy:0.76.2 fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 --no-progress /repo > /tmp/scan.log 2>&1
|
|
|
|
|
rc=$?
|
|
|
|
|
set -e
|
|
|
|
|
tail -n 120 /tmp/scan.log
|
|
|
|
@@ -163,15 +94,6 @@ jobs:
|
|
|
|
|
if [ $rc -eq 1 ]; then echo "::error::Trivy filesystem scan hittade fynd"; exit 1; fi
|
|
|
|
|
echo "::warning::Trivy filesystem scan kunde inte köras (rc=$rc) - verktygsfel, inte fynd"; exit 0
|
|
|
|
|
|
|
|
|
|
# Dockerfile- och IaC-misconfig är informativt: DS-0002 (root-USER)
|
|
|
|
|
# kräver ändrade runtime-användare och hanteras per repo, inte i grinden.
|
|
|
|
|
- name: Trivy config informational
|
|
|
|
|
continue-on-error: true
|
|
|
|
|
run: |
|
|
|
|
|
docker run --rm -v "$SCAN_VOLUME:/repo" -w /repo \
|
|
|
|
|
aquasec/trivy:0.76.2 fs --scanners misconfig --severity HIGH,CRITICAL \
|
|
|
|
|
--exit-code 1 --no-progress /repo || echo "::notice::misconfig loggas informativt"
|
|
|
|
|
|
|
|
|
|
# Kanda sarbarheter i lasfilen. osv-scanner 2.x hittar inte alltid
|
|
|
|
|
# osv-scanner.toml sjalv, sa den skickas explicit nar den finns.
|
|
|
|
|
- name: OSV Scanner
|
|
|
|
@@ -210,5 +132,4 @@ jobs:
|
|
|
|
|
- name: Remove scan volume
|
|
|
|
|
if: always()
|
|
|
|
|
run: |
|
|
|
|
|
for c in $(docker ps -q --filter "name=siax-gitleaks-.*-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"); do docker kill "$c" >/dev/null 2>&1 || true; done
|
|
|
|
|
docker volume rm -f "${SCAN_VOLUME:-none}" >/dev/null 2>&1 || true
|
|
|
|
|
admin
siax-bot
