file renamed and added debug code to check IP extraction #39
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security pipeline | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| jobs: | |
| gitleaks: | |
| name: Secrets scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history for gitleaks) | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| semgrep: | |
| name: SAST (Semgrep) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.x' | |
| - name: Install Semgrep | |
| run: python -m pip install --upgrade pip && pip install semgrep | |
| - name: Run Semgrep (produce SARIF) | |
| run: | | |
| # non-blocking first run; change below to add '--error' if you want to fail on findings | |
| semgrep scan --config p/ci --sarif > semgrep-results.sarif || true | |
| - name: Upload Semgrep SARIF | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: semgrep-sarif | |
| path: semgrep-results.sarif | |
| trivy: | |
| name: SCA / FS scan (Trivy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run Trivy FS scan (fail but continue) | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: HIGH,CRITICAL | |
| exit-code: 1 | |
| continue-on-error: true # <- goes here, not in "with:" | |
| checkov: | |
| name: IaC scan (Checkov) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run Checkov | |
| uses: bridgecrewio/checkov-action@v12 | |
| with: | |
| directory: . | |
| output_format: sarif | |
| output_file_path: checkov-results.sarif | |
| # soft_fail=true lets you tune rules first; set to false to make it block merges | |
| soft_fail: true | |
| - name: Upload Checkov SARIF | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: checkov-sarif | |
| path: checkov-results.sarif |