copier-fullstack-template/.github/workflows/codeql.yml at main · lfr-ai/copier-fullstack-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
name: CodeQL Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Run every Monday at 06:00 UTC
    - cron: '0 6 * * 1'

permissions:
  actions: read
  contents: read
  security-events: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 30

    strategy:
      fail-fast: false
      matrix:
        language: [python, javascript]
        include:
          - language: python
            path: template/backend
          - language: javascript
            path: template/frontend

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality
          config-file: ./.github/codeql/codeql-config.yml

      - name: Setup Python
        if: matrix.language == 'python'
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Install Python dependencies
        if: matrix.language == 'python'
        run: |
          python -m pip install --upgrade pip
          cd ${{ matrix.path }}
          if [ -f pyproject.toml ]; then
            pip install -e .[dev]
          fi

      - name: Setup Bun
        if: matrix.language == 'javascript'
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install JavaScript dependencies
        if: matrix.language == 'javascript'
        run: |
          cd ${{ matrix.path }}
          bun install

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"
          output: sarif-results
          upload: true

      - name: Upload SARIF as artifact
        uses: actions/upload-artifact@v4
        with:
          name: codeql-results-${{ matrix.language }}
          path: sarif-results
          retention-days: 30

  semgrep:
    name: Semgrep Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15

    container:
      image: semgrep/semgrep

    steps:
      - uses: actions/checkout@v6

      - name: Run Semgrep
        run: |
          semgrep scan \
            --config=auto \
            --sarif \
            --output=semgrep-results.sarif \
            --severity ERROR \
            --severity WARNING

      - name: Upload Semgrep results to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep-results.sarif
          category: semgrep

      - name: Upload Semgrep results as artifact
        uses: actions/upload-artifact@v4
        with:
          name: semgrep-results
          path: semgrep-results.sarif
          retention-days: 30

  trivy:
    name: Trivy Vulnerability Scanner
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@v6

      - name: Run Trivy filesystem scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif
          category: trivy

      - name: Upload Trivy results as artifact
        uses: actions/upload-artifact@v4
        with:
          name: trivy-results
          path: trivy-results.sarif
          retention-days: 30

  summary:
    name: Security Scan Summary
    runs-on: ubuntu-latest
    needs: [codeql, semgrep, trivy]
    if: always()

    steps:
      - name: Check scan results
        uses: actions/github-script@v7
        with:
          script: |
            const jobs = ${{ toJSON(needs) }};
            const failed = Object.entries(jobs).filter(([name, job]) => job.result === 'failure');

            if (failed.length > 0) {
              core.setFailed(`❌ ${failed.length} security scan(s) failed: ${failed.map(([name]) => name).join(', ')}`);
            } else {
              core.info('✅ All security scans passed!');
            }