hytale-server-container/.github/workflows/security-check.yml at 8a7dc5e2fb6938cc31020b928a96190e0f7e57e7 · deinfreu/hytale-server-container · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: "🔍 Security & Shell Lint"

on:
  push:
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  hadolint:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    strategy:
      matrix:
        dockerfile: [Dockerfile.alpine, Dockerfile.ubuntu, Dockerfile.alpine-liberica]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Install Hadolint
        run: |
          curl -sL https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint
          chmod +x /usr/local/bin/hadolint

      - name: Lint Dockerfile (SARIF + console)
        run: |
          echo "Linting ${{ matrix.dockerfile }}..."
          # Output SARIF for GitHub Code Scanning
          hadolint "${{ matrix.dockerfile }}" --no-fail -f sarif > "sarif-${{ matrix.dockerfile }}.sarif" || true
          # Also print warnings/errors in console for visibility
          hadolint "${{ matrix.dockerfile }}" || true

      - name: Upload Hadolint SARIF
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: "sarif-${{ matrix.dockerfile }}.sarif"
          category: hadolint

  trivy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Run Trivy Scan
        uses: aquasecurity/trivy-action@0.33.1
        with:
          scan-type: 'fs'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy SARIF
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
          category: trivy

  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@2.0.0
        continue-on-error: true
        with:
          scandir: './scripts'