Skip to content

Commit 35fa5dd

Browse files
mhuckamhucka
committed
Add security & code health workflows
This adds workflows for scanning repository files and assessing security issues and code/project health. Without any further configuration, the workflows will run once daily at night; they can also be added as CI checks in branch protection rules to trigger on pull requests.
1 parent 9872492 commit 35fa5dd

File tree

4 files changed

+281
-0
lines changed

4 files changed

+281
-0
lines changed

‎.github/workflows/codeql.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
# Zero-configuration modular workflow to run CodeQL code scans.
2+
#
3+
# CodeQL is a semantic code analysis tool that finds vulnerabilities by
4+
# understanding the code's logic. It is provided by GitHub. CodeQL's findings
5+
# are reported in the repo's code-scanning results page,
6+
# https://github.com/quantumlib/REPO/security/code-scanning/.
7+
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
8+
9+
name: CodeQL code scan
10+
run-name: Run CodeQL code scan ${{inputs.reason}}
11+
12+
on:
13+
pull_request:
14+
types: [opened, synchronize]
15+
branches:
16+
- main
17+
- master
18+
19+
# Support merge queues.
20+
merge_group:
21+
types:
22+
- checks_requested
23+
24+
# Allow manual invocation.
25+
workflow_dispatch:
26+
27+
# Allow calling from nightly.yaml.
28+
workflow_call:
29+
inputs:
30+
reason:
31+
type: string
32+
33+
# Declare default permissions as read only.
34+
permissions: read-all
35+
36+
jobs:
37+
create-matrix:
38+
name: Determine languages used
39+
runs-on: ubuntu-24.04
40+
timeout-minutes: 5
41+
outputs:
42+
language-matrix: ${{steps.matrix.outputs.languages}}
43+
steps:
44+
- name: Get list of programming languages used in this repo
45+
id: matrix
46+
uses: advanced-security/set-codeql-language-matrix@975244ea2e4c0668b8d289ac2b61fa7f0976f328 # v1
47+
with:
48+
access-token: ${{secrets.GITHUB_TOKEN}}
49+
endpoint: ${{github.event.repository.languages_url}}
50+
51+
codeql:
52+
if: ${{needs.create-matrix.outputs.language-matrix != '[]'}}
53+
name: Run CodeQL scanner for ${{matrix.language}}
54+
needs: create-matrix
55+
runs-on: ubuntu-24.04
56+
timeout-minutes: 10
57+
permissions:
58+
actions: read
59+
contents: read
60+
packages: read
61+
security-events: write
62+
strategy:
63+
fail-fast: false
64+
matrix:
65+
language: ${{fromJSON(needs.create-matrix.outputs.language-matrix)}}
66+
steps:
67+
- name: Check out a copy of the git repository
68+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
69+
70+
- name: Initialize CodeQL scanning tool
71+
uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
72+
with:
73+
languages: ${{matrix.language}}
74+
queries: security-and-quality
75+
config: |
76+
paths-ignore:
77+
- '**/*.gltf'
78+
- '**/*.json'
79+
- '**/*.md'
80+
- '**/*.png'
81+
- '**/*.rst'
82+
- '**/*.svg'
83+
- '**/*.stim'
84+
- '**/*.txt'
85+
86+
- name: Perform CodeQL Analysis
87+
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3
88+
with:
89+
category: "/language:${{matrix.language}}"

‎.github/workflows/nightly.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Run regular code scans and other checks every night.
2+
#
3+
# This workflow calls other workflows to do code scans on a schedule.
4+
# It can also be invoked manually via the "Run workflow" button at
5+
# https://github.com/quantumlib/REPO/actions/workflows/nightly.yaml
6+
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7+
8+
name: Nightly code scans
9+
run-name: Run nightly tests and code scans in ${{github.repository}}
10+
11+
on:
12+
schedule:
13+
- cron: '15 2 * * *'
14+
15+
# Allow manual invocation.
16+
workflow_dispatch:
17+
18+
# Declare default permissions as read only.
19+
permissions: read-all
20+
21+
jobs:
22+
codeql:
23+
name: Nightly CodeQL code scan
24+
uses: ./.github/workflows/codeql.yaml
25+
permissions: write-all
26+
with:
27+
reason: '(nightly)'
28+
29+
osv:
30+
name: Nightly OSV code scan
31+
uses: ./.github/workflows/osv-scanner.yaml
32+
permissions: write-all
33+
with:
34+
reason: '(nightly)'
35+
36+
scorecard:
37+
name: Nightly Scorecard analysis
38+
uses: ./.github/workflows/scorecard.yaml
39+
permissions: write-all
40+
secrets: inherit
41+
with:
42+
reason: '(nightly)'

‎.github/workflows/osv-scanner.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Zero-config modular workflow to run Open Source Vulnerabilities code scans.
2+
#
3+
# The OSV scanner is a dependency vulnerability scanner that identifies known
4+
# vulnerabilities in a project's dependencies. It supports C/C++, Python, Java,
5+
# JavaScript, and others. The findings are reported in the repo's code-scanning
6+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
7+
#
8+
# The OSV project provides a GA workflow that you can reference as a step with
9+
# "uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml".
10+
# Unfortunately, that workflow inexplicably doesn't use the latest version of
11+
# the scanner and reporter workflows, and also does other things like hard-code
12+
# the value of the osv-scanner "--gh-annotations" option to "false". Using the
13+
# separate scanner & reporter actions allows us to adjust the options and use
14+
# Dependabot to update the workflow versions as new ones are introduced.
15+
#
16+
# For more examples and options, including how to ignore specific
17+
# vulnerabilities, see https://google.github.io/osv-scanner/github-action/.
18+
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
19+
20+
name: OSV code scan
21+
run-name: Run OSV vulnerability scanner ${{inputs.reason}}
22+
23+
on:
24+
pull_request:
25+
types: [opened, synchronize]
26+
branches:
27+
- main
28+
- master
29+
30+
# Support merge queues.
31+
merge_group:
32+
types:
33+
- checks_requested
34+
35+
# Allow manual invocation.
36+
workflow_dispatch:
37+
38+
# Allow calling from nightly.yaml.
39+
workflow_call:
40+
inputs:
41+
reason:
42+
type: string
43+
44+
# Declare default permissions as read only.
45+
permissions: read-all
46+
47+
jobs:
48+
osv-scan:
49+
name: Run OSV scanner
50+
runs-on: ubuntu-24.04
51+
timeout-minutes: 15
52+
permissions:
53+
# Needed to upload the results to code-scanning dashboard.
54+
security-events: write
55+
# Read commit contents
56+
contents: read
57+
actions: read
58+
steps:
59+
- name: Check out a copy of the git repository
60+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
61+
with:
62+
persist-credentials: false
63+
64+
- name: Run OSV scanner on the repository files
65+
# yamllint disable rule:line-length
66+
uses: google/osv-scanner-action/osv-scanner-action@f8115f2f28022984d4e8070d2f0f85abcf6f3458 # v1.9.2
67+
continue-on-error: true
68+
with:
69+
scan-args: |-
70+
--format=json
71+
--output=osv-results.json
72+
--recursive
73+
./
74+
75+
- name: Run OSV reporter on the results of the scan
76+
# yamllint disable rule:line-length
77+
uses: google/osv-scanner-action/osv-reporter-action@f8115f2f28022984d4e8070d2f0f85abcf6f3458 # v1.9.2
78+
with:
79+
scan-args: |-
80+
--output=osv-results.sarif
81+
--new=osv-results.json
82+
--gh-annotations=true
83+
--fail-on-vuln=true
84+
85+
- name: Upload to the repository's code-scanning results dashboard
86+
uses: github/codeql-action/upload-sarif@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
87+
with:
88+
sarif_file: osv-results.sarif

‎.github/workflows/scorecard.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Zero-configuration modular workflow to run the OSSF Scorecard scanner.
2+
#
3+
# Scorecard (https://github.com/ossf/scorecard) is a repository-scanning tool
4+
# that evaluates a project's security practices. Its use is suggested by
5+
# Google's GitHub team. Scorecard's findings are reported in a repo's scanning
6+
# results page, https://github.com/quantumlib/REPO/security/code-scanning/.
7+
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
8+
9+
name: Scorecard analysis
10+
run-name: Run Scorecard best-practices analyzer ${{inputs.reason}}
11+
12+
on:
13+
pull_request:
14+
types: [opened, synchronize]
15+
branches:
16+
- main
17+
- master
18+
19+
# Support merge queues.
20+
merge_group:
21+
types:
22+
- checks_requested
23+
24+
# Allow manual invocation.
25+
workflow_dispatch:
26+
27+
# Allow calling from nightly.yaml.
28+
workflow_call:
29+
inputs:
30+
reason:
31+
type: string
32+
33+
# Declare default permissions as read only.
34+
permissions: read-all
35+
36+
jobs:
37+
scorecard:
38+
name: Run Scorecard analyzer
39+
runs-on: ubuntu-24.04
40+
timeout-minutes: 15
41+
permissions: write-all
42+
steps:
43+
- name: Check out a copy of the git repository
44+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
45+
with:
46+
persist-credentials: false
47+
48+
- name: Run Scorecard analysis
49+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
50+
with:
51+
# Save the results
52+
results_file: results.sarif
53+
results_format: sarif
54+
55+
# Publish results to OpenSSF REST API.
56+
# See https://github.com/ossf/scorecard-action#publishing-results.
57+
publish_results: true
58+
59+
- name: Upload results to code-scanning dashboard
60+
uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
61+
with:
62+
sarif_file: results.sarif

0 commit comments

Comments
 (0)