|
| 1 | +name: Security (OSS-CLI) |
| 2 | +# OSS-CLI security stack per RAN-54 AC §3 — replicates codeiq RAN-46 path B |
| 3 | +# (Sonar / CodeQL / OWASP-DC excluded by board ruling), language-adapted for |
| 4 | +# this single-file PowerShell project. |
| 5 | +# |
| 6 | +# Six independent jobs — fail-fast off so all signals surface on a single run. |
| 7 | +# All actions SHA-pinned per Scorecard `Pinned-Dependencies`. Top-level |
| 8 | +# `permissions: read-all` per Scorecard `Token-Permissions`; jobs scope up |
| 9 | +# only when needed (gitleaks needs full git history; sbom job uploads). |
| 10 | +# |
| 11 | +# PowerShell-variant deltas vs the codeiq Java stack: |
| 12 | +# - OSV-Scanner job is omitted: snipIT is a single .ps1 with zero external |
| 13 | +# dependencies (no npm / Maven / pip lockfile). Trivy filesystem scan |
| 14 | +# remains the SCA channel for any future deps; Dependabot covers the |
| 15 | +# GitHub Actions ecosystem. |
| 16 | +# - Semgrep packs: `p/security-audit` + `p/owasp-top-ten` only. Semgrep |
| 17 | +# has no first-party PowerShell pack today; the language-specific gate |
| 18 | +# is PSScriptAnalyzer (added below) — codeiq-equivalent of `p/java`. |
| 19 | +# - jscpd format set to `powershell`, scoped to the three .ps1 files. |
| 20 | +# - Added `psscriptanalyzer` job — language lint per |
| 21 | +# `shared/runbooks/engineering-standards.md` (PowerShell variant). |
| 22 | +on: |
| 23 | + push: |
| 24 | + branches: [main] |
| 25 | + pull_request: |
| 26 | + branches: [main] |
| 27 | + schedule: |
| 28 | + - cron: '21 4 * * 1' # Mondays 04:21 UTC — catch newly-disclosed CVEs |
| 29 | + |
| 30 | +permissions: read-all |
| 31 | + |
| 32 | +jobs: |
| 33 | + trivy: |
| 34 | + name: Trivy (filesystem + container scan) |
| 35 | + runs-on: ubuntu-latest |
| 36 | + permissions: |
| 37 | + contents: read |
| 38 | + steps: |
| 39 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 |
| 40 | + - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 |
| 41 | + with: |
| 42 | + scan-type: fs |
| 43 | + scan-ref: . |
| 44 | + severity: HIGH,CRITICAL |
| 45 | + exit-code: '1' |
| 46 | + ignore-unfixed: true |
| 47 | + |
| 48 | + semgrep: |
| 49 | + name: Semgrep (SAST) |
| 50 | + runs-on: ubuntu-latest |
| 51 | + permissions: |
| 52 | + contents: read |
| 53 | + steps: |
| 54 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 |
| 55 | + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 |
| 56 | + with: |
| 57 | + python-version: '3.12' |
| 58 | + - name: Install semgrep |
| 59 | + run: python -m pip install --quiet --upgrade pip semgrep |
| 60 | + - name: Run semgrep (security-audit + owasp-top-ten) |
| 61 | + # No `p/powershell` pack ships in Semgrep registry — language-level |
| 62 | + # findings come from PSScriptAnalyzer below. The two packs run here |
| 63 | + # are language-agnostic (path traversal, dangerous deserialization, |
| 64 | + # OWASP top-ten patterns) and still flag issues in .ps1 source. |
| 65 | + run: | |
| 66 | + semgrep scan \ |
| 67 | + --error \ |
| 68 | + --config p/security-audit \ |
| 69 | + --config p/owasp-top-ten \ |
| 70 | + --severity ERROR \ |
| 71 | + --metrics off |
| 72 | +
|
| 73 | + psscriptanalyzer: |
| 74 | + name: PSScriptAnalyzer (Error severity gate) |
| 75 | + runs-on: ubuntu-latest |
| 76 | + permissions: |
| 77 | + contents: read |
| 78 | + steps: |
| 79 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 |
| 80 | + - name: Install PSScriptAnalyzer |
| 81 | + shell: pwsh |
| 82 | + run: Install-Module PSScriptAnalyzer -Scope CurrentUser -Force -SkipPublisherCheck |
| 83 | + - name: Surface warnings (non-blocking) |
| 84 | + shell: pwsh |
| 85 | + run: | |
| 86 | + Import-Module PSScriptAnalyzer |
| 87 | + $w = Invoke-ScriptAnalyzer -Path ./SnipIT.ps1 -Severity Warning |
| 88 | + Write-Host "Warning count: $((@($w)).Count)" |
| 89 | + $w | Group-Object RuleName | Sort-Object Count -Descending | |
| 90 | + Select-Object Count, Name | Format-Table -AutoSize | Out-String | Write-Host |
| 91 | + - name: Fail on Error-severity findings |
| 92 | + shell: pwsh |
| 93 | + run: | |
| 94 | + Import-Module PSScriptAnalyzer |
| 95 | + $errs = Invoke-ScriptAnalyzer -Path ./SnipIT.ps1 -Severity Error |
| 96 | + $count = (@($errs)).Count |
| 97 | + Write-Host "Error count: $count" |
| 98 | + if ($count -gt 0) { |
| 99 | + $errs | Format-Table -AutoSize Severity, RuleName, Line, Message | |
| 100 | + Out-String | Write-Host |
| 101 | + exit 1 |
| 102 | + } |
| 103 | +
|
| 104 | + gitleaks: |
| 105 | + name: Gitleaks (secret scan) |
| 106 | + runs-on: ubuntu-latest |
| 107 | + permissions: |
| 108 | + contents: read |
| 109 | + env: |
| 110 | + GITLEAKS_VERSION: 8.30.1 |
| 111 | + GH_TOKEN: ${{ github.token }} |
| 112 | + steps: |
| 113 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 |
| 114 | + with: |
| 115 | + fetch-depth: 0 |
| 116 | + # The official `gitleaks/gitleaks-action` requires a paid license for |
| 117 | + # GitHub organisations. The underlying gitleaks CLI is MIT-licensed and |
| 118 | + # free; install it directly from the upstream release. Using the |
| 119 | + # preinstalled `gh` CLI avoids any external `curl`/`wget`. |
| 120 | + - name: Install gitleaks |
| 121 | + run: | |
| 122 | + gh release download "v${GITLEAKS_VERSION}" \ |
| 123 | + --repo gitleaks/gitleaks \ |
| 124 | + --pattern "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ |
| 125 | + --output gitleaks.tar.gz |
| 126 | + tar -xzf gitleaks.tar.gz gitleaks |
| 127 | + chmod +x gitleaks |
| 128 | + - name: Run gitleaks (full git history) |
| 129 | + run: ./gitleaks detect --source . --redact --no-banner --exit-code 1 |
| 130 | + |
| 131 | + jscpd: |
| 132 | + name: jscpd (duplication < 3% on touched code) |
| 133 | + runs-on: ubuntu-latest |
| 134 | + permissions: |
| 135 | + contents: read |
| 136 | + steps: |
| 137 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 |
| 138 | + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 |
| 139 | + with: |
| 140 | + node-version: '20' |
| 141 | + - run: | |
| 142 | + # snipIT is three PowerShell files at repo root: |
| 143 | + # - SnipIT.ps1 (production) |
| 144 | + # - Test-SnipIT.ps1 (headless tests) |
| 145 | + # - Test-SnipIT-Interactive.ps1 (interactive tests) |
| 146 | + # |
| 147 | + # Production-only scope per AC interpretation (matches codeiq |
| 148 | + # convention where tests are excluded from the dup gate). Tests |
| 149 | + # share fixture / Assert-* shape by design. |
| 150 | + # |
| 151 | + # `--min-tokens 100` is calibrated to PowerShell's medium verbosity |
| 152 | + # floor (Add-Type/[CmdletBinding] blocks, `param()` headers, P/Invoke |
| 153 | + # signatures). The Java floor of 200 over-suppresses; the jscpd |
| 154 | + # default of 50 surfaces param-block boilerplate as false-positive |
| 155 | + # clones. 100 captures real duplicate logic without flagging the |
| 156 | + # 8–15 line `[CmdletBinding()]` + `param(...)` openers many |
| 157 | + # functions share. |
| 158 | + npx --yes jscpd@4 \ |
| 159 | + --threshold 3 \ |
| 160 | + --min-tokens 100 \ |
| 161 | + --reporters consoleFull \ |
| 162 | + --format "powershell" \ |
| 163 | + --ignore "**/Test-SnipIT*.ps1,**/docs/**" \ |
| 164 | + ./SnipIT.ps1 |
| 165 | +
|
| 166 | + sbom: |
| 167 | + name: SBOM (SPDX + CycloneDX) |
| 168 | + runs-on: ubuntu-latest |
| 169 | + permissions: |
| 170 | + contents: read |
| 171 | + steps: |
| 172 | + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.2.2 |
| 173 | + - name: Generate SPDX SBOM |
| 174 | + uses: anchore/sbom-action@fc46e51fd3cb168ffb36c6d1915723c47db58abb # v0.17.7 |
| 175 | + with: |
| 176 | + format: spdx-json |
| 177 | + output-file: sbom.spdx.json |
| 178 | + upload-artifact: false |
| 179 | + - name: Generate CycloneDX SBOM |
| 180 | + uses: anchore/sbom-action@fc46e51fd3cb168ffb36c6d1915723c47db58abb # v0.17.7 |
| 181 | + with: |
| 182 | + format: cyclonedx-json |
| 183 | + output-file: sbom.cdx.json |
| 184 | + upload-artifact: false |
| 185 | + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2 |
| 186 | + with: |
| 187 | + name: sbom |
| 188 | + path: | |
| 189 | + sbom.spdx.json |
| 190 | + sbom.cdx.json |
| 191 | + retention-days: 90 |
0 commit comments