Skip to content

Commit 05b9fbf

Browse files
mhuckamhucka
authored
Add security scan workflows (#889)
1 parent cffe087 commit 05b9fbf

File tree

2 files changed

+261
-0
lines changed

2 files changed

+261
-0
lines changed

‎.github/workflows/osv-scanner.yaml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: OSV vulnerabilities scan
16+
run-name: Run open-source vulnerabilities (OSV) scanner
17+
18+
# The OSV scanner is a dependency vulnerability scanner that identifies known
19+
# vulnerabilities in a project's dependencies. It supports C/C++, Python, Java,
20+
# JavaScript, and others. The findings are reported in the repo's code-scanning
21+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
22+
# For more OSV scanner examples and options, including how to ignore specific
23+
# vulnerabilities, see https://google.github.io/osv-scanner/github-action/.
24+
25+
on:
26+
schedule:
27+
# Run weekly on Saturdays.
28+
- cron: '30 10 * * 6'
29+
30+
pull_request:
31+
types: [opened, synchronize]
32+
branches:
33+
- main
34+
- master
35+
36+
# Support merge queues.
37+
merge_group:
38+
types:
39+
- checks_requested
40+
41+
# Allow manual invocation.
42+
workflow_dispatch:
43+
inputs:
44+
debug:
45+
description: 'Run with debugging options'
46+
type: boolean
47+
default: true
48+
49+
concurrency:
50+
# Cancel any previously-started but still active runs on the same branch.
51+
cancel-in-progress: true
52+
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
53+
54+
# Declare default workflow permissions as read only.
55+
permissions: read-all
56+
57+
jobs:
58+
osv-scan:
59+
if: github.repository_owner == 'quantumlib'
60+
name: OSV scanner
61+
runs-on: ubuntu-24.04
62+
timeout-minutes: 15
63+
permissions:
64+
# Needed to upload the results to code-scanning dashboard:
65+
security-events: write
66+
env:
67+
# Setting Bash SHELLOPTS here takes effect for all shell commands below.
68+
SHELLOPTS: ${{inputs.debug && 'xtrace' || '' }}
69+
steps:
70+
- name: Check out a copy of the git repository
71+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
72+
with:
73+
fetch-depth: 0
74+
75+
- name: Check out the target branch
76+
run: |
77+
git checkout ${{github.base_ref || github.ref_name}}
78+
git submodule update --recursive
79+
80+
- name: Run OSV scanner on existing code
81+
# yamllint disable rule:line-length
82+
uses: google/osv-scanner-action/osv-scanner-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
83+
continue-on-error: true
84+
with:
85+
scan-args: |-
86+
--include-git-root
87+
--format=json
88+
--output=old-results.json
89+
--recursive
90+
./
91+
92+
- name: Check out current branch
93+
# Use -f in case any changes were made by osv-scanner.
94+
run: |
95+
git checkout -f "$GITHUB_SHA"
96+
git submodule update --recursive
97+
98+
- name: Run OSV scanner on new code
99+
# yamllint disable rule:line-length
100+
uses: google/osv-scanner-action/osv-scanner-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
101+
continue-on-error: true
102+
with:
103+
scan-args: |-
104+
--include-git-root
105+
--format=json
106+
--output=new-results.json
107+
--recursive
108+
./
109+
110+
- name: Run the OSV scanner reporter for the job summary page
111+
# yamllint disable rule:line-length
112+
uses: google/osv-scanner-action/osv-reporter-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
113+
with:
114+
scan-args: |-
115+
--output=markdown:output.md
116+
--old=old-results.json
117+
--new=new-results.json
118+
--fail-on-vuln=false
119+
120+
- name: Write the results to the job summary page
121+
run: cat output.md >> "$GITHUB_STEP_SUMMARY"
122+
123+
- name: Run the OSV scanner reporter for the code-scanning dashboard
124+
# yamllint disable rule:line-length
125+
uses: google/osv-scanner-action/osv-reporter-action@b00f71e051ddddc6e46a193c31c8c0bf283bf9e6 # v2.1.0
126+
with:
127+
scan-args: |-
128+
--output=osv-results.sarif
129+
--old=old-results.json
130+
--new=new-results.json
131+
--gh-annotations=true
132+
--fail-on-vuln=true
133+
134+
- name: Upload results to the repository's code-scanning results dashboard
135+
id: upload_artifact
136+
# yamllint disable rule:line-length
137+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
138+
with:
139+
sarif_file: osv-results.sarif
140+
141+
- if: github.event.inputs.debug == true
142+
name: Upload results as artifacts to the workflow Summary page
143+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
144+
with:
145+
name: SARIF file
146+
path: osv-results.sarif
147+
retention-days: 5
148+
149+
- name: Print an alert message if an error occurred
150+
if: ${{always() && steps.upload_artifact.outcome == 'failure'}}
151+
run: echo '::error::Artifact upload failed. Check the workflow logs.'

‎.github/workflows/scorecard-scanner.yaml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: Scorecard analysis
16+
run-name: Run Scorecard scanner for security best practices
17+
18+
# Scorecard (https://github.com/ossf/scorecard) is a repository-scanning tool
19+
# that evaluates a project's security practices. Its use is suggested by
20+
# Google's GitHub team. Scorecard's findings are reported in a repo's scanning
21+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
22+
23+
on:
24+
schedule:
25+
# Run weekly on Saturdays.
26+
- cron: '30 9 * * 6'
27+
28+
pull_request:
29+
types: [opened, synchronize]
30+
branches:
31+
- main
32+
- master
33+
34+
# Support merge queues.
35+
merge_group:
36+
types:
37+
- checks_requested
38+
39+
# Allow manual invocation.
40+
workflow_dispatch:
41+
inputs:
42+
debug:
43+
description: 'Run with debugging options'
44+
type: boolean
45+
default: true
46+
47+
concurrency:
48+
# Cancel any previously-started but still active runs on the same branch.
49+
cancel-in-progress: true
50+
group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
51+
52+
# Declare default workflow permissions as read only.
53+
permissions: read-all
54+
55+
jobs:
56+
run-scorecard:
57+
if: github.repository_owner == 'quantumlib'
58+
name: Scorecard analyzer
59+
runs-on: ubuntu-24.04
60+
permissions:
61+
security-events: write
62+
id-token: write
63+
timeout-minutes: 15
64+
steps:
65+
- name: Check out a copy of the git repository
66+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
67+
with:
68+
persist-credentials: false
69+
70+
- name: Run Scorecard analysis
71+
# yamllint disable rule:line-length
72+
uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
73+
with:
74+
# Save the results
75+
results_file: scorecard-results.sarif
76+
results_format: sarif
77+
# See https://github.com/ossf/scorecard-action#publishing-results.
78+
publish_results: true
79+
80+
- name: Upload results to code-scanning dashboard
81+
# yamllint disable rule:line-length
82+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
83+
with:
84+
sarif_file: scorecard-results.sarif
85+
86+
- if: github.event.inputs.debug == true
87+
name: Upload results as artifacts to the workflow Summary page
88+
# yamllint disable rule:line-length
89+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
90+
with:
91+
name: Scorecard SARIF file
92+
path: scorecard-results.sarif
93+
retention-days: 5
94+
95+
# Scorecard currently (ver. 2.4.x) doesn't allow submissions from jobs having
96+
# steps that use "run:". To print to the summary, we need to use another job.
97+
write-summary:
98+
name: Scorecard results
99+
needs: run-scorecard
100+
runs-on: ubuntu-24.04
101+
timeout-minutes: 5
102+
steps:
103+
- name: Write the Scorecard report page link to the workflow summary
104+
run: |
105+
repo="${{github.repository}}"
106+
url="https://scorecard.dev/viewer/?uri=github.com/${repo}"
107+
{
108+
echo -n "The results are available on the OpenSSF Scorecard "
109+
echo "[report page for ${{github.repository}}]($url)."
110+
} >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)