mirror of
https://github.com/ethereum/go-ethereum.git
synced 2026-07-25 22:26:42 +00:00
50a778207e
* dev: add: pos-944 security ci and readme * dev: add: pos-944 remove linters as this is included already in build ci * dev: chg: pos-947 dependencies upgrade to solve snyk security issues * dev: chg: update security-ci * dev: chg: remove linter to allow replacements for security issues * dev: add: pos-944 verify path when updating metrics from config * dev: add: pos-944 fix linter * dev: add: pos-944 add .snyk policy file / fix snyk code vulnerabilities * dev: fix: pos-944 import common package / gitignore snyk dccache file * dev: fix: pos-944 verify canonical path for crashers * dev: fix: pos-944 linter * dev: add: pos-976 add govuln check * dev: add: pos-976 test upload with permissions * dev: add: pos-976 remove duplicated upload * dev: add: pos-976 report upload * dev: add: pos-976 remove upload * dev: fix: pos-944 fix govuln action * dev: fix: pos-944 move govulncheck to security-ci * dev: fix: pos-944 bump golvun action and golang versions * dev: fix: pos-944 remove persmissions and fix conflicts * dev: chg: restore err msg * dev: chg: remove duplicated function * dev: chg: sort import * dev: chg: fix linter * dev: add: use common VerifyCrasher function to avoid duplications / replace deprecated ioutils.ReadFile * dev: fix: typo
64 lines
1.9 KiB
YAML
64 lines
1.9 KiB
YAML
name: Security CI
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
snyk:
|
|
name: Snyk and Publish
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Source
|
|
uses: actions/checkout@master
|
|
- name: Run Snyk to check for vulnerabilities
|
|
uses: snyk/actions/golang@master
|
|
continue-on-error: true
|
|
env:
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
with:
|
|
args: --org=${{ secrets.SNYK_ORG }} --severity-threshold=medium --sarif-file-output=snyk.sarif
|
|
- name: Upload result to GitHub Code Scanning
|
|
uses: github/codeql-action/upload-sarif@v2
|
|
with:
|
|
sarif_file: snyk.sarif
|
|
|
|
snyk-code:
|
|
name: Snyk Code and Publish
|
|
runs-on: ubuntu-latest
|
|
continue-on-error: true
|
|
steps:
|
|
- name: Checkout Source
|
|
uses: actions/checkout@master
|
|
- name: Run Snyk SAST to check for code vulnerabilities
|
|
uses: snyk/actions/golang@master
|
|
continue-on-error: true
|
|
env:
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
with:
|
|
args: --org=${{ secrets.SNYK_ORG }} --sarif-file-output=snyk.sarif
|
|
command: code test
|
|
- name: Upload result to GitHub Code Scanning
|
|
uses: github/codeql-action/upload-sarif@v2
|
|
with:
|
|
sarif_file: snyk.sarif
|
|
|
|
govuln:
|
|
name: Run govuln check and Publish
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
- name: Running govulncheck
|
|
uses: Templum/govulncheck-action@v0.0.8
|
|
continue-on-error: true
|
|
env:
|
|
DEBUG: "true"
|
|
with:
|
|
go-version: 1.19
|
|
vulncheck-version: latest
|
|
package: ./...
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
fail-on-vuln: true
|
|
|
|
- name: Upload govulncheck report
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: raw-report
|
|
path: raw-report.json
|