security.yml

name: Security

on:
  push:
    tags:
      - v*
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  # ------------------------------

  govulncheck:
    runs-on: ubuntu-latest
    name: govulncheck
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - uses: arduino/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: setup
        run: task setup

      - name: install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: run govulncheck
        run: govulncheck ./...

  # ------------------------------

  semgrep:
    runs-on: ubuntu-latest
    name: semgrep
    container:
      image: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v4

      - uses: actions/checkout@v4
        with:
          repository: dgryski/semgrep-go
          path: rules

      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: semgrep
        run: semgrep scan --error --enable-nosem -f ./rules .

  # ------------------------------

  gitleaks:
    runs-on: ubuntu-latest
    name: gitleaks
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}}
        if: ${{ env.GITLEAKS_LICENSE != '' }}

  # -----------------------------

  grype-scan:
    runs-on: ubuntu-latest
    name: grype-scan

    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
      - uses: actions/checkout@v4

      - uses: anchore/scan-action@v3
        with:
          path: "."
          fail-build: true