Feature/update actions #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔒 Security Scan | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 2 * * 1' # Weekly on Monday at 2 AM UTC | |
| jobs: | |
| # CodeQL Analysis | |
| codeql: | |
| name: 🔍 CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['csharp'] | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v6 | |
| - name: 🔍 Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| - name: 🔍 Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: 🔍 Perform Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| # Snyk Security Scan | |
| snyk: | |
| name: 🛡️ Snyk Security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v6 | |
| - name: 🗄️ Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: "8.0.x" | |
| - name: 🔧 Restore Dependencies | |
| run: dotnet restore MetarDecoder.sln --ignore-failed-sources | |
| - name: 🛡️ Run Snyk | |
| uses: snyk/actions/dotnet@master | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| with: | |
| args: --severity-threshold=high | |
| # SonarQube Analysis | |
| sonarqube: | |
| name: 📊 SonarQube Analysis | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: 📥 Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: 🗄️ Setup .NET | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: "8.0.x" | |
| - name: 📦 Setup NuGet | |
| uses: NuGet/setup-nuget@v2.0.1 | |
| - name: 🔧 Restore Dependencies | |
| run: dotnet restore MetarDecoder.sln --ignore-failed-sources | |
| - name: 🏗️ Build Solution | |
| run: dotnet build MetarDecoder.sln --configuration Release --no-restore | |
| - name: 📊 SonarQube Scan | |
| uses: sonarsource/sonarcloud-github-action@master | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| # Security Summary | |
| security-summary: | |
| name: 📋 Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [codeql, snyk, sonarqube] | |
| if: always() | |
| steps: | |
| - name: 📋 Generate Security Report | |
| run: | | |
| echo "## 🔒 Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| Tool | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| 🔍 CodeQL | ${{ needs.codeql.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| 🛡️ Snyk | ${{ needs.snyk.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| 📊 SonarQube | ${{ needs.sonarqube.result }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [[ "${{ needs.codeql.result }}" == "failure" || "${{ needs.snyk.result }}" == "failure" || "${{ needs.sonarqube.result }}" == "failure" ]]; then | |
| echo "❌ **Security issues detected! Please review the scan results.**" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "✅ **All security scans passed successfully!**" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: 🚨 Security Alert | |
| if: needs.codeql.result == 'failure' || needs.snyk.result == 'failure' || needs.sonarqube.result == 'failure' | |
| run: | | |
| echo "🚨 SECURITY ISSUES DETECTED!" | |
| echo "Please review the security scan results immediately." |