scan.yml

#
# Run a scan using Snyk and secgo
#
name: Scan
on:
  push:
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 0"

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

permissions: read-all

jobs:
  snyk:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    strategy:
      fail-fast: false
    runs-on: ubuntu-24.04

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@446798f8213ac2e75931c1b0769676d927801858 # v1
        with:
          egress-policy: block
          disable-telemetry: true
          allowed-endpoints: >
            api.github.com:443
            api.snyk.io:443
            github.com:443
            proxy.golang.org:443
            snyk.io:443
          
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v2.4.0
        
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/golang@b98d498629f1c368650224d6d212bf7dfa89e4bf # master
        continue-on-error: true # To make sure that SARIF upload gets called
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --sarif-file-output=snyk.sarif
          
      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v1
        with:
          sarif_file: snyk.sarif

  gosec:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    strategy:
      fail-fast: false
    runs-on: ubuntu-24.04
    
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@446798f8213ac2e75931c1b0769676d927801858 # v1
        with:
          egress-policy: block
          disable-telemetry: true
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            proxy.golang.org:443
            snyk.io:443
          
      - name: Checkout Source
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v2
        
      - name: Run Gosec Security Scanner
        uses: securego/gosec@abfe8cfd6d5687c96abf31f8e7f57982df2a6e4f # master
        with:
          # we let the report trigger content trigger a failure using the GitHub Security features.
          args: '-no-fail -fmt sarif -out results.sarif ./...'
          
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v1
        with:
          # Path to SARIF file relative to the root of the repository
          sarif_file: results.sarif