plugin-ipc/.github/workflows/supply-chain-security.yml at main · netdata/plugin-ipc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Supply Chain Security

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: "11 04 * * 1"
  workflow_dispatch:

permissions:
  actions: read
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  semgrep:
    name: Semgrep Secrets
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.x"

      - name: Install Semgrep
        run: python -m pip install --upgrade semgrep

      - name: Run Semgrep
        run: |
          semgrep scan \
            --metrics=off \
            --config p/secrets \
            --sarif \
            --output semgrep.sarif \
            .

      - name: Upload Semgrep SARIF
        if: always() && hashFiles('semgrep.sarif') != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: semgrep.sarif
          category: semgrep

  osv-scanner:
    name: OSV-Scanner
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest

    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: "1.26.x"
          cache: false

      - name: Install OSV-Scanner
        run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest

      - name: Run OSV-Scanner
        id: osv
        run: |
          set +e
          "$(go env GOPATH)/bin/osv-scanner" scan --recursive --format sarif --output-file osv.sarif .
          status=$?
          echo "status=$status" >> "$GITHUB_OUTPUT"
          exit 0

      - name: Upload OSV SARIF
        if: always() && hashFiles('osv.sarif') != ''
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: osv.sarif
          category: osv-scanner

      - name: Fail on OSV vulnerabilities
        if: steps.osv.outputs.status != '0'
        env:
          OSV_STATUS: ${{ steps.osv.outputs.status }}
        run: |
          echo "OSV-Scanner exited with status ${OSV_STATUS}" >&2
          exit 1

  scorecard:
    name: OpenSSF Scorecard
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write

    steps:
      - name: Harden runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Run Scorecard
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_file: scorecard.json
          results_format: json
          publish_results: true

      - name: Upload Scorecard artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: scorecard-results
          path: scorecard.json
          retention-days: 5