example-code-analysis.yml.text

name: GHAS Code Scans
# https://github.com/github/codeql-action

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  repository_dispatch:
    types: [code-scan]
  workflow_dispatch:
  schedule:
    #        ┌───────────── minute (0 - 59)
    #        │  ┌───────────── hour (0 - 23)
    #        │  │ ┌───────────── day of the month (1 - 31)
    #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
    #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
    #        │  │ │ │ │
    #        │  │ │ │ │
    #        │  │ │ │ │
    #        *  * * * *
    - cron: "30 1 * * 0"

jobs:


  Dependency-Review:
    runs-on: im-ghas-linux
    if: github.event_name == 'pull_request'

    permissions:
      actions: read # only required for workflows in private repositories
      contents: read # for actions/checkout fetch code
      pull-requests: write # can write to pull requests
      security-events: write # required for all workflows

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      # https://github.com/actions/dependency-review-action
      - name: Dependency Review
        uses: actions/dependency-review-action@v3
        with:
          fail-on-severity: moderate


  CodeQL-Scan-csharp:
    runs-on: im-ghas-linux # if windows needed im-windows (depending on your needs, you may need to make a custom DYN windows runner based off the im-windows runner)

    env:
      DOTNET_VERSION: |
        6.0
      SOLUTION_FILE: ./path/to/solution.sln
      DOTNET_INSTALL_DIR: dotnet-install

    permissions:
      actions: read # only required for workflows in private repositories
      contents: read # for actions/checkout fetch code
      pull-requests: write # can write to pull requests
      security-events: write # required for all workflows

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Setup .NET Core
        uses: actions/setup-dotnet@v3
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}
        env:
          DOTNET_INSTALL_DIR: ${{ env.DOTNET_INSTALL_DIR }}

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          ram: 1536 # Give 1.5 GB ram to CodeQL, 1024 can lead to out of memory issues for some C# repos
          # Using additional queries to get more results
          # See https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#using-queries-in-ql-packs
          queries: security-and-quality
          languages: csharp

      - name: Authenticate with GitHub Packages
        uses: im-open/authenticate-with-gh-package-registries@v1.0.5
        with:
          read-pkg-token: ${{ secrets.READ_PKG_TOKEN }} # This is an org-level secret
          orgs: "im-platform"

      - name: dotnet build
        run: dotnet build ${{ env.SOLUTION_FILE }} --configuration Release

      - name: Perform C# CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: /codeql-scan:csharp


  Terraform-Scan:
    runs-on: im-ghas-linux

    permissions:
      actions: read # only required for workflows in private repositories
      contents: read # for actions/checkout fetch code
      pull-requests: write # can write to pull requests
      security-events: write # required for all workflows

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Perform Terraform Scan
        # Rules Lookup
        # https://aquasecurity.github.io/tfsec/v1.28.1/checks/azure/
        uses: aquasecurity/tfsec-sarif-action@v0.1.4
        with:
          sarif_file: terraform.sarif

      - name: Upload Terraform SARIF results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: terraform.sarif


  PowerShell-Scan:
    runs-on: im-ghas-linux

    permissions:
      actions: read # only required for workflows in private repositories
      contents: read # for actions/checkout fetch code
      pull-requests: write # can write to pull requests
      security-events: write # required for all workflows

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Perform PowerShell Scan
        # Rules URL
        # https://github.com/PowerShell/PSScriptAnalyzer/blob/master/docs/Rules/README.md
        uses: microsoft/psscriptanalyzer-action@v1.1
        with:
          # Check https://github.com/microsoft/psscriptanalyzer-action for more info about the options.
          # The below set up runs PSScriptAnalyzer to your entire repository and runs some basic security rules.
          path: .\
          recurse: true
          output: powershell.sarif

      - name: Upload PowerShell SARIF results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: powershell.sarif


  CodeQL-Scan:
    strategy:
      matrix:
        languages: [javascript, python]

    runs-on: im-ghas-linux

    permissions:
      actions: read # only required for workflows in private repositories
      contents: read # for actions/checkout fetch code
      pull-requests: write # can write to pull requests
      security-events: write # required for all workflows

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # For JavaScript use filter-sarif action so we can remove results from dist folders
      # https://github.com/advanced-security/filter-sarif

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          ram: 1024
          # Using additional queries to get more results
          # See https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/customizing-code-scanning#using-queries-in-ql-packs
          queries: security-and-quality
          languages: ${{ matrix.languages }}

      # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java).
      # If this step fails, then you should remove it and run the build manually (see below).
      - name: Autobuild
        uses: github/codeql-action/autobuild@v2

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun

      # ✏️ If the Autobuild fails above, remove it and uncomment the following
      #    three lines and modify them (or add more) to build your code if your
      #    project uses a compiled language

      # - run: |
      #   echo "Run, Build Application using script"
      #   ./location_of_script_within_repo/buildscript.sh

      # Perform normal analysis
      - name: Perform CodeQL Analysis
        if: matrix.languages != 'javascript'
        uses: github/codeql-action/analyze@v2
        with:
          category: /codeql-scan:${{ matrix.languages }}

      # For JavaScript run analysis differently so we can ignore directories in the results
      - name: Perform JavaScript CodeQL Analysis
        if: matrix.languages == 'javascript'
        uses: github/codeql-action/analyze@v2
        with:
          category: /codeql-scan:${{ matrix.languages }}
          upload: False
          output: sarif-results

      - name: Filter JavaScript SARIF Results
        if: matrix.languages == 'javascript'
        # Information about this tool
        # https://github.com/advanced-security/filter-sarif
        uses: advanced-security/filter-sarif@09a9626fe5e89584ba5ed115143975bfc59ac6a9
        with:
          # Remove results under dist directory
          patterns: |
            -**/dist/**
          input: sarif-results/javascript.sarif
          output: sarif-results/javascript.sarif

      - name: Upload JavaScript SARIF Results
        if: matrix.languages == 'javascript'
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: sarif-results/javascript.sarif