scouter/.github/workflows/security.yml at main · Rogercode97/scouter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Security Audit

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '0 0 * * 0' # Run weekly on Sundays

jobs:
  security:
    name: Go Security Scans
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.26'
          check-latest: true

      - name: Install dependencies (gopls, ast-grep)
        run: |
          go install golang.org/x/tools/gopls@v0.20.0
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
          curl -L https://github.com/ast-grep/ast-grep/releases/latest/download/app-x86_64-unknown-linux-gnu.zip -o ast-grep.zip
          unzip ast-grep.zip
          sudo mv ast-grep sg /usr/local/bin/
          rm ast-grep.zip

      - name: Run Gosec Security Scanner
        uses: securego/gosec@master
        with:
          args: -exclude=G104,G301,G304,G306,G204,G115,G302,G702 ./...

      - name: Run Govulncheck
        continue-on-error: true
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          $(go env GOPATH)/bin/govulncheck github.com/Rogercode97/scouter/...

  race-detector:
    name: Race Detector
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.26'
          check-latest: true

      - name: Install dependencies (gopls, ast-grep)
        run: |
          go install golang.org/x/tools/gopls@v0.20.0
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
          curl -L https://github.com/ast-grep/ast-grep/releases/latest/download/app-x86_64-unknown-linux-gnu.zip -o ast-grep.zip
          unzip ast-grep.zip
          sudo mv ast-grep sg /usr/local/bin/
          rm ast-grep.zip

      - name: Run Tests with Race Detector
        run: |
          export PATH=$PATH:$(go env GOPATH)/bin
          go test -race -v -p 1 ./...