name: Security CI
on: [ push, pull_request ]

jobs:
  snyk:
    name: Snyk and Publish
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Source
        uses: actions/checkout@master
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/golang@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --org=${{ secrets.SNYK_ORG }} --severity-threshold=medium --sarif-file-output=snyk.sarif
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk.sarif

  snyk-code:
    name: Snyk Code and Publish
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Checkout Source
        uses: actions/checkout@master
      - name: Run Snyk SAST to check for code vulnerabilities
        uses: snyk/actions/golang@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --org=${{ secrets.SNYK_ORG }} --sarif-file-output=snyk.sarif
          command: code test
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: snyk.sarif

  govuln:
    name: Run govuln check and Publish
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Running govulncheck
        uses: Templum/govulncheck-action@v0.0.8
        continue-on-error: true
        env:
          DEBUG: "true"
        with:
          go-version: 1.19
          vulncheck-version: latest
          package: ./...
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-on-vuln: true

      - name: Upload govulncheck report
        uses: actions/upload-artifact@v3
        with:
          name: raw-report
          path: raw-report.json

  sonarqube:
    name: SonarQube
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          # Disabling shallow clone is recommended for improving relevancy of reporting.
          fetch-depth: 0

      # Triggering SonarQube analysis as results of it are required by Quality Gate check.
      - name: SonarQube Scan
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      # Check the Quality Gate status.
      - name: SonarQube Quality Gate check
        id: sonarqube-quality-gate-check
        uses: sonarsource/sonarqube-quality-gate-action@master
        # Force to fail step after specific time.
        timeout-minutes: 5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}