devsecops-week6/.github/workflows/ci-sca-multi.yml at main · kimookoii/devsecops-week6 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: CI - Multi SCA (Node + PHP)

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
  schedule:
    - cron: '0 3 * * *' # daily 03:00 UTC

permissions:
  contents: read

jobs:
  sca-and-build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node (if package.json present)
        if: ${{ hashFiles('**/package.json') != '' }}
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Setup PHP (if composer.json present)
        if: ${{ hashFiles('**/composer.json') != '' }}
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.1'

      - name: Install Node deps (ci if lockfile)
        if: ${{ hashFiles('**/package.json') != '' }}
        run: |
          echo "Installing Node dependencies..."
          if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
            echo "Found lockfile -> running npm ci"
            npm ci
          else
            echo "No lockfile -> running npm install"
            npm install
          fi

      - name: Install Composer deps (non-fatal)
        if: ${{ hashFiles('**/composer.json') != '' }}
        run: |
          echo "Installing Composer dependencies (no-dev)..."
          composer install --no-interaction --prefer-dist --no-dev || true

      - name: Run tests (node) if available
        if: ${{ hashFiles('**/package.json') != '' }}
        run: |
          if npm run | grep -q " test"; then
            echo "Running npm test..."
            npm test || true
          else
            echo "No test script found, skipping tests"
          fi

      - name: Run Snyk - npm (if package.json present)
        if: ${{ hashFiles('**/package.json') != '' }}
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          echo "Preparing Snyk npm scan..."
          if [ -z "$SNYK_TOKEN" ]; then
            echo "SNYK_TOKEN not set. Skipping Snyk npm scan." > snyk-npm-exit.txt
          else
            snyk test --package-manager=npm || echo "snyk-npm-failed" > snyk-npm-exit.txt
            snyk monitor --package-manager=npm || true
          fi

      - name: Run Snyk - composer (if composer.json present)
        if: ${{ hashFiles('**/composer.json') != '' }}
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          echo "Preparing Snyk composer scan..."
          if [ -z "$SNYK_TOKEN" ]; then
            echo "SNYK_TOKEN not set. Skipping Snyk composer scan." > snyk-composer-exit.txt
          else
            if [ -f composer.lock ]; then
              snyk test --file=composer.lock --package-manager=composer || echo "snyk-composer-failed" > snyk-composer-exit.txt
              snyk monitor --file=composer.lock --package-manager=composer || true
            else
              snyk test --file=composer.json --package-manager=composer || echo "snyk-composer-failed" > snyk-composer-exit.txt
              snyk monitor --file=composer.json --package-manager=composer || true
            fi
          fi

      - name: Run OWASP Dependency-Check (Docker)
        run: |
          echo "Running OWASP Dependency-Check (may take a while on first run)..."
          mkdir -p reports || true
          docker run --rm \
            -v "${{ github.workspace }}:/src" \
            -v "${{ runner.temp }}/dc-data:/usr/share/dependency-check/data" \
            owasp/dependency-check:latest \
            --scan /src --format "HTML" --out /src/reports || true

      - name: List reports (debug)
        run: |
          echo "Reports directory listing:"
          ls -la reports || true
          echo "Root listing:"
          ls -la || true

      - name: Upload reports artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: sca-reports
          path: |
            reports/dependency-check-report.html
            snyk-npm-exit.txt
            snyk-composer-exit.txt

      - name: Summary (logs)
        if: always()
        run: |
          echo "SCA pipeline completed. Check Artifacts -> sca-reports for outputs."