security #1644
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "security" | |
| permissions: | |
| actions: read | |
| contents: read | |
| on: | |
| workflow_dispatch: | |
| # Uncomment when testing. | |
| # pull_request: | |
| schedule: | |
| # Run every 6 hours Monday-Friday! | |
| - cron: "0 0/6 * * 1-5" | |
| # Cancel in-progress runs for pull requests when developers push | |
| # additional changes | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-security | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| codeql: | |
| permissions: | |
| security-events: write | |
| runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1 | |
| - name: Setup Go | |
| uses: ./.github/actions/setup-go | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 | |
| with: | |
| languages: go, javascript | |
| # Workaround to prevent CodeQL from building the dashboard. | |
| - name: Remove Makefile | |
| run: | | |
| rm Makefile | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 | |
| - name: Send Slack notification on failure | |
| if: ${{ failure() }} | |
| run: | | |
| msg="❌ CodeQL Failed\n\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| curl \ | |
| -qfsSL \ | |
| -X POST \ | |
| -H "Content-Type: application/json" \ | |
| --data "{\"content\": \"$msg\"}" \ | |
| "${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}" | |
| trivy: | |
| permissions: | |
| security-events: write | |
| runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Go | |
| uses: ./.github/actions/setup-go | |
| - name: Setup Node | |
| uses: ./.github/actions/setup-node | |
| - name: Setup sqlc | |
| uses: ./.github/actions/setup-sqlc | |
| - name: Install yq | |
| run: go run github.com/mikefarah/yq/v4@v4.30.6 | |
| - name: Install mockgen | |
| run: go install go.uber.org/mock/mockgen@v0.4.0 | |
| - name: Install protoc-gen-go | |
| run: go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30 | |
| - name: Install protoc-gen-go-drpc | |
| run: go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.33 | |
| - name: Install Protoc | |
| run: | | |
| # protoc must be in lockstep with our dogfood Dockerfile or the | |
| # version in the comments will differ. This is also defined in | |
| # ci.yaml. | |
| set -euxo pipefail | |
| cd dogfood/contents | |
| mkdir -p /usr/local/bin | |
| mkdir -p /usr/local/include | |
| DOCKER_BUILDKIT=1 docker build . --target proto -t protoc | |
| protoc_path=/usr/local/bin/protoc | |
| docker run --rm --entrypoint cat protoc /tmp/bin/protoc > $protoc_path | |
| chmod +x $protoc_path | |
| protoc --version | |
| # Copy the generated files to the include directory. | |
| docker run --rm -v /usr/local/include:/target protoc cp -r /tmp/include/google /target/ | |
| ls -la /usr/local/include/google/protobuf/ | |
| stat /usr/local/include/google/protobuf/timestamp.proto | |
| - name: Build Coder linux amd64 Docker image | |
| id: build | |
| run: | | |
| set -euo pipefail | |
| version="$(./scripts/version.sh)" | |
| image_job="build/coder_${version}_linux_amd64.tag" | |
| # This environment variable force make to not build packages and | |
| # archives (which the Docker image depends on due to technical reasons | |
| # related to concurrent FS writes). | |
| export DOCKER_IMAGE_NO_PREREQUISITES=true | |
| # This environment variables forces scripts/build_docker.sh to build | |
| # the base image tag locally instead of using the cached version from | |
| # the registry. | |
| export CODER_IMAGE_BUILD_BASE_TAG="$(CODER_IMAGE_BASE=coder-base ./scripts/image_tag.sh --version "$version")" | |
| # We would like to use make -j here, but it doesn't work with the some recent additions | |
| # to our code generation. | |
| make "$image_job" | |
| echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 | |
| with: | |
| image-ref: ${{ steps.build.outputs.image }} | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| category: "Trivy" | |
| - name: Upload Trivy scan results as an artifact | |
| uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1 | |
| with: | |
| name: trivy | |
| path: trivy-results.sarif | |
| retention-days: 7 | |
| - name: Send Slack notification on failure | |
| if: ${{ failure() }} | |
| run: | | |
| msg="❌ Trivy Failed\n\nhttps://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| curl \ | |
| -qfsSL \ | |
| -X POST \ | |
| -H "Content-Type: application/json" \ | |
| --data "{\"content\": \"$msg\"}" \ | |
| "${{ secrets.SLACK_SECURITY_FAILURE_WEBHOOK_URL }}" |