Repository navigation
175 lines (164 loc) · 5.86 KB
/
Copy pathanalysis.yml
File metadata and controls
175 lines (164 loc) · 5.86 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
name: Analysis
on:
push:
branches: [main]
pull_request:
types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
schedule:
- cron: "0 11 * * 0" # 3 AM PST = 12 PM UDT, runs sundays
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions: {}
jobs:
tests-java:
name: Backend Tests
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
permissions:
pull-requests: write
secrets: inherit
uses: ./.github/workflows/reusable-tests-be.yml
tests-frontend:
name: Frontend Unit Tests
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
secrets: inherit
permissions:
contents: write
checks: write
uses: ./.github/workflows/reusable-tests-fe.yml
tests-frontend-ex:
name: Frontend UI Tests
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
secrets: inherit
permissions:
contents: write
checks: write
uses: ./.github/workflows/reusable-tests-fe-extra.yml
trivy:
name: Repository Report
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
permissions:
contents: read
security-events: write
runs-on: ubuntu-26.04
steps:
- uses: actions/checkout@v7
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
format: "sarif"
output: "trivy-results.sarif"
ignore-unfixed: true
scan-type: "fs"
scanners: "vuln,secret,misconfig"
severity: "CRITICAL,HIGH"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: "trivy-results.sarif"
cve-lite:
name: CVE Lite Scan (${{ matrix.folder }})
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
permissions:
contents: read
security-events: write
runs-on: ubuntu-26.04
strategy:
matrix:
folder: [cypress, frontend]
steps:
- uses: actions/checkout@v7
- name: Setup Node.js
uses: actions/setup-node@v7
with:
node-version: "26"
- name: Run cve-lite-cli SARIF scan (${{ matrix.folder }})
run: npx --yes cve-lite-cli@1.25.0 "${{ matrix.folder }}" --sarif --check-overrides
- name: Locate SARIF file
id: locate
run: |
sarif_file=$(ls ${{ github.workspace }}/cve-lite-scan-*.sarif 2>/dev/null | head -1)
if [ -z "$sarif_file" ]; then
echo "::error::No SARIF file found in ${{ github.workspace }}"
exit 1
fi
echo "path=$sarif_file" >> $GITHUB_OUTPUT
- name: Fix SARIF artifact paths to include folder prefix
run: |
FILE="${{ steps.locate.outputs.path }}"
jq --arg folder "${{ matrix.folder }}" '
# Only prefix URIs that are relative (no scheme like https://)
def prefix_uri:
if . == null then .
elif test("^[a-zA-Z][a-zA-Z0-9+\\-\\.]*:") then .
else $folder + "/" + .
end;
# Fix results: iterate all runs, all results, all locations
.runs |= map(
.results |= (if type == "array" then map(
.locations |= (if type == "array" then map(
.physicalLocation.artifactLocation.uri |= prefix_uri
) else . end)
) else . end)
) |
# Fix artifacts: iterate all runs, all artifacts
.runs |= map(
.artifacts |= (if type == "array" then map(
.location.uri |= prefix_uri
) else . end)
)
' "$FILE" > "${FILE}.fixed" && mv "${FILE}.fixed" "$FILE"
- name: Upload SARIF to GitHub Security tab
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: ${{ steps.locate.outputs.path }}
category: "cve-lite-${{ matrix.folder }}"
npm-audit:
name: npm Audit (${{ matrix.folder }})
if: github.event_name != 'pull_request' || !github.event.pull_request.draft
permissions:
contents: read
runs-on: ubuntu-26.04
strategy:
fail-fast: false
matrix:
folder: [cypress, frontend]
steps:
- uses: actions/checkout@v7
- name: Setup Node.js
uses: actions/setup-node@v7
with:
node-version: "26"
cache: npm
cache-dependency-path: ${{ matrix.folder }}/package-lock.json
- name: Test audit allowlist script
run: node --test .github/scripts/*.test.cjs
- name: Run npm audit (${{ matrix.folder }})
working-directory: ${{ matrix.folder }}
run: |
npm audit --package-lock-only --audit-level=high || \
node "${{ github.workspace }}/.github/scripts/npm-audit-allowlist.cjs" \
--folder "${{ matrix.folder }}" \
--allowlist "${{ github.workspace }}/.github/scripts/audit-allowlist.json"
# ==========================================================================
# WARNING: This job acts as the required merge gate for this workflow.
# If you add a new job to this workflow, you MUST add its ID to the 'needs'
# array below, otherwise its failure or cancellation will not block the PR!
# ==========================================================================
results:
name: Analysis Results
needs:
- tests-java
- tests-frontend
- tests-frontend-ex
- trivy
- cve-lite
- npm-audit
if: always()
runs-on: ubuntu-26.04
timeout-minutes: 1
steps:
- uses: bcgov/actions/workflow-results@091f1da89c669d36bf4899830381e5b12d2c889a # v0.11.0
with:
needs: ${{ toJson(needs) }}