Skip to content

Commit b480734

Browse files
Som3a99Som3a99
authored
ci: update workflows to improve compatibility with private repositories and enhance security scans (#19)
1 parent 6978ad1 commit b480734

4 files changed

Lines changed: 5 additions & 286 deletions

File tree

‎.github/workflows/ci-tests-coverage.yml‎

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -50,69 +50,17 @@ jobs:
5050
/p:ExcludeByFile="**/Migrations/*.cs%3b**/Areas/Identity/**/*.cs%3b**/*.g.cs%3b**/*.designer.cs"
5151
- name: Install ReportGenerator for HTML coverage
5252
if: always()
53-
<<<<<<< HEAD
54-
<<<<<<< HEAD
55-
<<<<<<< HEAD
56-
<<<<<<< HEAD
57-
=======
58-
>>>>>>> 4f764d7 (Add k6 load testing suite and documentation)
59-
=======
60-
>>>>>>> cf4208d (ci: format ReportGenerator installation and update commands for clarity)
6153
run: |
6254
dotnet tool install -g dotnet-reportgenerator-globaltool || dotnet tool update -g dotnet-reportgenerator-globaltool
6355
echo "$HOME/.dotnet/tools" >> $GITHUB_PATH
64-
=======
65-
run: dotnet tool install -g dotnet-reportgenerator-globaltool || dotnet tool update -g dotnet-reportgenerator-globaltool
66-
>>>>>>> 800dd81 (Add k6 load testing suite and documentation)
67-
<<<<<<< HEAD
68-
<<<<<<< HEAD
69-
=======
70-
>>>>>>> cf4208d (ci: format ReportGenerator installation and update commands for clarity)
71-
=======
72-
run: |
73-
dotnet tool install -g dotnet-reportgenerator-globaltool || dotnet tool update -g dotnet-reportgenerator-globaltool
74-
echo "$HOME/.dotnet/tools" >> $GITHUB_PATH
75-
>>>>>>> 348a276 (ci: format ReportGenerator installation and update commands for clarity)
76-
<<<<<<< HEAD
77-
=======
78-
>>>>>>> 4f764d7 (Add k6 load testing suite and documentation)
79-
=======
80-
>>>>>>> cf4208d (ci: format ReportGenerator installation and update commands for clarity)
8156
8257
- name: Generate HTML coverage report
8358
if: always()
8459
run: |
8560
reportgenerator \
86-
<<<<<<< HEAD
87-
<<<<<<< HEAD
88-
<<<<<<< HEAD
89-
<<<<<<< HEAD
90-
=======
91-
>>>>>>> 4f764d7 (Add k6 load testing suite and documentation)
92-
=======
93-
>>>>>>> cf4208d (ci: format ReportGenerator installation and update commands for clarity)
94-
-reports:"TestResults/**/coverage.cobertura.xml" \
95-
-targetdir:"TestResults/coverage-html" \
96-
-reporttypes:"Html;HtmlSummary"
97-
=======
98-
-reports:TestResults/**/coverage.cobertura.xml \
99-
-targetdir:TestResults/coverage-html \
100-
-reporttypes:Html;HtmlSummary
101-
>>>>>>> 800dd81 (Add k6 load testing suite and documentation)
102-
<<<<<<< HEAD
103-
<<<<<<< HEAD
104-
=======
105-
>>>>>>> cf4208d (ci: format ReportGenerator installation and update commands for clarity)
106-
=======
10761
-reports:"TestResults/**/coverage.cobertura.xml" \
10862
-targetdir:"TestResults/coverage-html" \
10963
-reporttypes:"Html;HtmlSummary"
110-
>>>>>>> 348a276 (ci: format ReportGenerator installation and update commands for clarity)
111-
<<<<<<< HEAD
112-
=======
113-
>>>>>>> 4f764d7 (Add k6 load testing suite and documentation)
114-
=======
115-
>>>>>>> cf4208d (ci: format ReportGenerator installation and update commands for clarity)
11664
11765
11866
- name: Upload test results and coverage

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 0 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -17,32 +17,8 @@ permissions:
1717
jobs:
1818
analyze:
1919
name: Analyze C# Code
20-
<<<<<<< HEAD
21-
<<<<<<< HEAD
22-
<<<<<<< HEAD
23-
<<<<<<< HEAD
24-
=======
25-
>>>>>>> 09e91ff (ci: update security workflows to check for private repository status)
26-
=======
27-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
2820
# Removed: if: github.event.repository.private == false
2921
# That condition caused the job to be permanently skipped on private repos.
30-
=======
31-
if: github.event.repository.private == false
32-
>>>>>>> aef5768 (ci: update security workflows to check for private repository status)
33-
<<<<<<< HEAD
34-
<<<<<<< HEAD
35-
=======
36-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
37-
=======
38-
# Removed: if: github.event.repository.private == false
39-
# That condition caused the job to be permanently skipped on private repos.
40-
>>>>>>> e20a634 (ci: update workflows to remove private repository condition for security scans)
41-
<<<<<<< HEAD
42-
=======
43-
>>>>>>> 09e91ff (ci: update security workflows to check for private repository status)
44-
=======
45-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
4622
runs-on: ubuntu-latest
4723
timeout-minutes: 30
4824

@@ -80,48 +56,11 @@ jobs:
8056
uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
8157
with:
8258
category: "/language:${{ matrix.language }}"
83-
<<<<<<< HEAD
84-
<<<<<<< HEAD
85-
<<<<<<< HEAD
86-
<<<<<<< HEAD
87-
=======
88-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
89-
=======
90-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
91-
=======
92-
=======
93-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
94-
>>>>>>> 41d52d6 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
9559
# FIX: Disable SARIF upload to GitHub's code-scanning API.
9660
# This repo is private without GitHub Advanced Security, so the upload
9761
# endpoint returns "Code scanning is not enabled" and fails the job.
9862
# The scan itself completes successfully — disabling upload lets the
9963
# job pass while preserving full analysis coverage.
10064
# To re-enable: remove this line and enable Code Scanning at
10165
# Settings → Code security → Code scanning (requires GHAS).
102-
<<<<<<< HEAD
103-
<<<<<<< HEAD
104-
<<<<<<< HEAD
105-
=======
106-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
107-
=======
108-
>>>>>>> 41d52d6 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
109-
upload: false
110-
=======
111-
# upload: false is NOT set — we attempt upload normally.
112-
# On private repos without GHAS the upload will warn but the job still passes
113-
# because the action only hard-errors when security-events write is explicitly denied.
114-
continue-on-error: false
115-
>>>>>>> e20a634 (ci: update workflows to remove private repository condition for security scans)
116-
<<<<<<< HEAD
117-
<<<<<<< HEAD
118-
=======
119-
upload: false
120-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
121-
=======
122-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
123-
=======
124-
=======
12566
upload: false
126-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
127-
>>>>>>> 41d52d6 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)

‎.github/workflows/gitleaks.yml‎

Lines changed: 5 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -32,104 +32,14 @@ jobs:
3232
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
3333
env:
3434
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35-
<<<<<<< HEAD
36-
<<<<<<< HEAD
37-
<<<<<<< HEAD
38-
<<<<<<< HEAD
39-
=======
40-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
41-
=======
42-
>>>>>>> 41d52d6 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
4335
# GITLEAKS_CONFIG points to your custom rules file at repo root.
4436
GITLEAKS_CONFIG: .gitleaks.toml
45-
<<<<<<< HEAD
46-
<<<<<<< HEAD
47-
# FIX: gitleaks-action v2 auto-generates a SARIF file internally and
48-
# handles its own artifact upload when GITLEAKS_ENABLE_UPLOAD_ARTIFACT=true
49-
# (the default). The `with.args` parameter does not exist in this action
50-
# and was silently ignored — that is why results.sarif was never written
51-
# to disk, causing the upload step to fail with "file not found".
52-
# Uploading SARIF to the code-scanning API also requires GitHub Advanced
53-
# Security (GHAS), which is not available on private free-plan repos.
54-
# We therefore disable the built-in artifact upload and instead capture
55-
# the report ourselves below using actions/upload-artifact (no GHAS needed).
56-
GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
57-
=======
58-
with:
59-
args: detect --source=. --report-format sarif --report-path results.sarif
60-
>>>>>>> aef5768 (ci: update security workflows to check for private repository status)
61-
62-
- name: Upload Gitleaks report as workflow artifact
63-
# Run even when gitleaks finds secrets (exit code 1) so the report is
64-
# always available for review — but skip when the step was cancelled.
65-
if: always() && steps.gitleaks.outcome != 'cancelled'
66-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
67-
with:
68-
name: gitleaks-report
69-
# gitleaks-action v2 writes the SARIF to this fixed path
70-
path: results.sarif
71-
if-no-files-found: ignore
72-
=======
73-
# Fix: In gitleaks-action v2, report format/path are controlled via
74-
# GITLEAKS_REPORT_FORMAT and GITLEAKS_REPORT_PATH env vars, NOT via
75-
# the `with.args` parameter (which is ignored by this action version).
37+
# FIX: In gitleaks-action v2, report format/path are controlled by env vars.
38+
# The action does not support `with.args` in this pinned version.
7639
GITLEAKS_REPORT_FORMAT: sarif
7740
GITLEAKS_REPORT_PATH: results.sarif
78-
<<<<<<< HEAD
79-
<<<<<<< HEAD
80-
=======
81-
# GITLEAKS_CONFIG points to your custom rules file at repo root.
82-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
83-
GITLEAKS_CONFIG: .gitleaks.toml
84-
=======
85-
>>>>>>> 09e91ff (ci: update security workflows to check for private repository status)
86-
# FIX: gitleaks-action v2 auto-generates a SARIF file internally and
87-
# handles its own artifact upload when GITLEAKS_ENABLE_UPLOAD_ARTIFACT=true
88-
# (the default). The `with.args` parameter does not exist in this action
89-
# and was silently ignored — that is why results.sarif was never written
90-
# to disk, causing the upload step to fail with "file not found".
91-
# Uploading SARIF to the code-scanning API also requires GitHub Advanced
92-
# Security (GHAS), which is not available on private free-plan repos.
93-
# We therefore disable the built-in artifact upload and instead capture
94-
# the report ourselves below using actions/upload-artifact (no GHAS needed).
95-
GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
96-
=======
97-
with:
98-
args: detect --source=. --report-format sarif --report-path results.sarif
99-
>>>>>>> aef5768 (ci: update security workflows to check for private repository status)
100-
101-
- name: Upload Gitleaks report as workflow artifact
102-
# Run even when gitleaks finds secrets (exit code 1) so the report is
103-
# always available for review — but skip when the step was cancelled.
104-
if: always() && steps.gitleaks.outcome != 'cancelled'
105-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
106-
with:
107-
<<<<<<< HEAD
108-
sarif_file: results.sarif
109-
continue-on-error: true
110-
>>>>>>> e20a634 (ci: update workflows to remove private repository condition for security scans)
111-
=======
112-
name: gitleaks-report
113-
# gitleaks-action v2 writes the SARIF to this fixed path
114-
path: results.sarif
115-
if-no-files-found: ignore
116-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
117-
=======
118-
=======
119-
=======
120-
# GITLEAKS_CONFIG points to your custom rules file at repo root.
121-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
122-
>>>>>>> 41d52d6 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
123-
GITLEAKS_CONFIG: .gitleaks.toml
124-
# FIX: gitleaks-action v2 auto-generates a SARIF file internally and
125-
# handles its own artifact upload when GITLEAKS_ENABLE_UPLOAD_ARTIFACT=true
126-
# (the default). The `with.args` parameter does not exist in this action
127-
# and was silently ignored — that is why results.sarif was never written
128-
# to disk, causing the upload step to fail with "file not found".
129-
# Uploading SARIF to the code-scanning API also requires GitHub Advanced
130-
# Security (GHAS), which is not available on private free-plan repos.
131-
# We therefore disable the built-in artifact upload and instead capture
132-
# the report ourselves below using actions/upload-artifact (no GHAS needed).
41+
# FIX: Disable built-in artifact upload and upload explicitly below.
42+
# This avoids dependency on code-scanning integrations in private repos.
13343
GITLEAKS_ENABLE_UPLOAD_ARTIFACT: false
13444

13545
- name: Upload Gitleaks report as workflow artifact
@@ -138,17 +48,6 @@ jobs:
13848
if: always() && steps.gitleaks.outcome != 'cancelled'
13949
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
14050
with:
141-
<<<<<<< HEAD
142-
sarif_file: results.sarif
143-
continue-on-error: true
144-
>>>>>>> e20a634 (ci: update workflows to remove private repository condition for security scans)
145-
<<<<<<< HEAD
146-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
147-
=======
148-
=======
14951
name: gitleaks-report
150-
# gitleaks-action v2 writes the SARIF to this fixed path
15152
path: results.sarif
152-
if-no-files-found: ignore
153-
>>>>>>> a7cca78 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
154-
>>>>>>> 41d52d6 (ci: update CodeQL and Gitleaks workflows to improve handling of private repositories and artifact uploads)
53+
if-no-files-found: ignore

‎.github/workflows/security-scans.yml‎

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -12,79 +12,12 @@ permissions:
1212
contents: read
1313

1414
jobs:
15-
<<<<<<< HEAD
16-
<<<<<<< HEAD
17-
<<<<<<< HEAD
18-
<<<<<<< HEAD
19-
=======
20-
>>>>>>> 319cdfb (ci: remove dependency review job to enhance compatibility with private repositories)
21-
=======
22-
>>>>>>> 09e91ff (ci: update security workflows to check for private repository status)
23-
=======
24-
=======
25-
>>>>>>> 319cdfb (ci: remove dependency review job to enhance compatibility with private repositories)
26-
>>>>>>> 82c510d (ci: remove dependency review job to enhance compatibility with private repositories)
2715
# NOTE: actions/dependency-review-action has been intentionally removed.
2816
# It hard-requires GitHub Advanced Security (GHAS) on private repositories —
2917
# the Dependency Graph being enabled is necessary but not sufficient.
3018
# GHAS is only available on GitHub Enterprise plans.
3119
# Equivalent coverage is provided by dotnet-vulnerability-scan below,
3220
# which uses `dotnet list --vulnerable` and needs no special GitHub features.
33-
<<<<<<< HEAD
34-
<<<<<<< HEAD
35-
<<<<<<< HEAD
36-
=======
37-
>>>>>>> 82c510d (ci: remove dependency review job to enhance compatibility with private repositories)
38-
=======
39-
dependency-review:
40-
name: Dependency Review
41-
# Fix: Removed `github.event.repository.private == false` — that condition
42-
# permanently skips this job on private repos.
43-
#
44-
# Dependency Review requires the Dependency Graph to be enabled in your
45-
# repository settings (Settings → Code security → Dependency graph).
46-
# It does NOT require GitHub Advanced Security on private repos —
47-
# the Dependency Graph feature is available on all GitHub plans.
48-
# Enable it at: https://github.com/Som3a99/company-management-system/settings/security_analysis
49-
if: github.event_name == 'pull_request'
50-
=======
51-
=======
52-
dependency-review:
53-
name: Dependency Review
54-
<<<<<<< HEAD
55-
if: github.event_name == 'pull_request' && github.event.repository.private == false
56-
>>>>>>> 09e91ff (ci: update security workflows to check for private repository status)
57-
=======
58-
# Fix: Removed `github.event.repository.private == false` — that condition
59-
# permanently skips this job on private repos.
60-
#
61-
# Dependency Review requires the Dependency Graph to be enabled in your
62-
# repository settings (Settings → Code security → Dependency graph).
63-
# It does NOT require GitHub Advanced Security on private repos —
64-
# the Dependency Graph feature is available on all GitHub plans.
65-
# Enable it at: https://github.com/Som3a99/company-management-system/settings/security_analysis
66-
if: github.event_name == 'pull_request'
67-
>>>>>>> 3712a2e (ci: update workflows to remove private repository condition for security scans)
68-
runs-on: ubuntu-latest
69-
timeout-minutes: 10
70-
steps:
71-
- name: Checkout
72-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
73-
- name: Dependency Review
74-
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
75-
with:
76-
fail-on-severity: moderate
77-
>>>>>>> aef5768 (ci: update security workflows to check for private repository status)
78-
<<<<<<< HEAD
79-
<<<<<<< HEAD
80-
=======
81-
>>>>>>> 319cdfb (ci: remove dependency review job to enhance compatibility with private repositories)
82-
=======
83-
>>>>>>> 09e91ff (ci: update security workflows to check for private repository status)
84-
=======
85-
=======
86-
>>>>>>> 319cdfb (ci: remove dependency review job to enhance compatibility with private repositories)
87-
>>>>>>> 82c510d (ci: remove dependency review job to enhance compatibility with private repositories)
8821

8922
dotnet-vulnerability-scan:
9023
name: .NET Vulnerability Audit

0 commit comments

Comments
 (0)