Security Scan (Dashboard & Log) #267
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan (Dashboard & Log) | |
| # Decision: Use Trivy + GitHub Code Scanning for lightweight, dashboard-integrated security | |
| # Reason: Hackathon-friendly (non-blocking, fast), better UX than Issue accumulation | |
| on: | |
| push: | |
| branches: ["main", "develop"] | |
| pull_request: | |
| branches: ["main", "develop"] | |
| schedule: | |
| # Daily at 3:00 AM JST for comprehensive scan | |
| - cron: "0 18 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write # Required for uploading to Security tab | |
| jobs: | |
| trivy-scan: | |
| name: Trivy Security Scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| # 1. Console output for immediate feedback in CI logs | |
| - name: Run Trivy (Log Output) | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| format: "table" | |
| exit-code: "0" # Don't fail CI (hackathon-friendly) | |
| severity: "CRITICAL,HIGH" | |
| trivyignores: ".trivyignore" | |
| # 2. SARIF output for GitHub Security tab integration | |
| - name: Run Trivy (SARIF Output) | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| exit-code: "0" # Don't fail CI | |
| severity: "CRITICAL,HIGH" | |
| trivyignores: ".trivyignore" | |
| # 3. Upload results to GitHub Security tab (visible like Dependabot alerts) | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() # Upload even if scan found issues | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| category: "trivy-fs-scan" | |
| secret-scan: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: TruffleHog Secret Scan | |
| uses: trufflesecurity/trufflehog@v3.82.13 | |
| with: | |
| path: ./ | |
| extra_args: --only-verified | |
| continue-on-error: true |