rosa-tf/.github/workflows/security.yml at 2a82b5ca342e9d1de5c18f7c4fa3130a58709eef · supernovae/rosa-tf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
# Security and Quality Checks
# Runs on all PRs and pushes to main

name: Security Checks

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  #----------------------------------------------------------------------------
  # Shell Script Security
  #----------------------------------------------------------------------------
  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          scandir: "."
          severity: warning
          format: gcc
        env:
          SHELLCHECK_OPTS: -x -e SC1091

  #----------------------------------------------------------------------------
  # Terraform Security Scanning
  # tfsec + Checkov provide comprehensive IaC coverage.
  #----------------------------------------------------------------------------
  tfsec:
    name: tfsec Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install tfsec
        run: |
          curl -sLo tfsec https://github.com/aquasecurity/tfsec/releases/latest/download/tfsec-linux-amd64
          chmod +x tfsec
          sudo mv tfsec /usr/local/bin/

      - name: Run tfsec
        run: |
          tfsec . --format sarif --out tfsec-results.sarif --soft-fail || true
          if [ ! -s tfsec-results.sarif ]; then
            echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/Schemata/sarif-schema-2.1.0.json","runs":[{"tool":{"driver":{"name":"tfsec","rules":[]}},"results":[]}]}' > tfsec-results.sarif
          fi

      - name: Upload tfsec results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: tfsec-results.sarif

  #----------------------------------------------------------------------------
  # Vulnerability Scanning
  #----------------------------------------------------------------------------
  grype:
    name: Grype Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Run Grype filesystem scan
        uses: anchore/scan-action@v7
        id: grype
        with:
          path: "."
          fail-build: false
          severity-cutoff: high
          output-format: sarif
          output-file: grype-results.sarif

      - name: Upload Grype results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: grype-results.sarif

  checkov:
    name: Checkov
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Run Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          framework: terraform
          soft_fail: true
          output_format: sarif
          output_file_path: checkov-results.sarif
          config_file: .checkov.yml

      - name: Upload Checkov results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: checkov-results.sarif

  #----------------------------------------------------------------------------
  # Secrets Detection
  #----------------------------------------------------------------------------
  gitleaks:
    name: Gitleaks Secret Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  trufflehog:
    name: TruffleHog Secret Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Run TruffleHog
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

  #----------------------------------------------------------------------------
  # Terraform Validation
  #----------------------------------------------------------------------------
  terraform-validate:
    name: Terraform Validate
    runs-on: ubuntu-latest
    strategy:
      matrix:
        environment:
          - commercial-classic
          - commercial-hcp
          - govcloud-classic
          - govcloud-hcp
    steps:
      - uses: actions/checkout@v6

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: "~> 1.6"

      - name: Terraform Format Check
        run: terraform fmt -check -recursive

      - name: Terraform Init
        working-directory: environments/${{ matrix.environment }}
        run: terraform init -backend=false

      - name: Terraform Validate
        working-directory: environments/${{ matrix.environment }}
        run: terraform validate

  #----------------------------------------------------------------------------
  # YAML Linting
  #----------------------------------------------------------------------------
  yaml-lint:
    name: YAML Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Run yamllint
        uses: ibiqlik/action-yamllint@v3
        with:
          file_or_dir: "."
          config_file: .yamllint.yml
        continue-on-error: true