O-RAN-Intent-MANO-for-Network-Slicing/.github/workflows/trivy-scan.yml at main · thc1006/O-RAN-Intent-MANO-for-Network-Slicing · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
name: Trivy Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read
  packages: read

jobs:
  trivy-scan:
    name: Trivy Security Scan
    runs-on: ubuntu-24.04
    timeout-minutes: 30

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ secrets.GITHUB_TOKEN }}
        persist-credentials: false

    - name: Run Trivy vulnerability scanner in repo mode
      uses: aquasecurity/trivy-action@0.28.0
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH,MEDIUM'
        exit-code: '0'  # Don't fail the build

    - name: Check SARIF file
      run: |
        if [ -f trivy-results.sarif ]; then
          echo "SARIF file generated successfully"
          echo "File size: $(ls -lh trivy-results.sarif | awk '{print $5}')"
          # Validate JSON structure
          if python3 -m json.tool trivy-results.sarif > /dev/null 2>&1; then
            echo "SARIF file is valid JSON"
          else
            echo "Warning: SARIF file may have invalid JSON"
          fi
        else
          echo "Error: SARIF file not generated"
          exit 1
        fi

    - name: Upload Trivy scan results
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'trivy-results.sarif'
        category: 'trivy-filesystem'
        wait-for-processing: false
      env:
        GITHUB_TOKEN: ${{ github.token }}
      continue-on-error: true

    - name: Alternative - Upload as artifact if SARIF upload fails
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: trivy-sarif-results
        path: trivy-results.sarif
        retention-days: 7

  gosec-scan:
    name: GoSec Security Scan
    runs-on: ubuntu-24.04
    timeout-minutes: 20

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
        token: ${{ secrets.GITHUB_TOKEN }}
        persist-credentials: false

    - name: Set up Go
      uses: actions/setup-go@v5
      with:
        go-version: '1.24.7'

    - name: Run gosec Security Scanner
      uses: securego/gosec@master
      with:
        args: '-fmt sarif -out gosec-results.sarif -severity medium ./...'
      continue-on-error: true

    - name: Check and fix SARIF file
      run: |
        if [ -f gosec-results.sarif ]; then
          echo "GoSec SARIF file generated"
          # Sometimes gosec generates empty results, create a minimal valid SARIF
          if [ ! -s gosec-results.sarif ]; then
            echo "GoSec SARIF is empty, creating minimal valid SARIF"
            cat > gosec-results.sarif << 'EOF'
        {
          "version": "2.1.0",
          "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
          "runs": [
            {
              "tool": {
                "driver": {
                  "name": "gosec",
                  "version": "2.0.0",
                  "informationUri": "https://github.com/securego/gosec"
                }
              },
              "results": []
            }
          ]
        }
        EOF
          fi
        else
          echo "No GoSec SARIF file generated, creating minimal valid SARIF"
          cat > gosec-results.sarif << 'EOF'
        {
          "version": "2.1.0",
          "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
          "runs": [
            {
              "tool": {
                "driver": {
                  "name": "gosec",
                  "version": "2.0.0",
                  "informationUri": "https://github.com/securego/gosec"
                }
              },
              "results": []
            }
          ]
        }
        EOF
        fi

    - name: Upload GoSec scan results
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: 'gosec-results.sarif'
        category: 'gosec'
        wait-for-processing: false
      env:
        GITHUB_TOKEN: ${{ github.token }}
      continue-on-error: true

    - name: Alternative - Upload as artifact if SARIF upload fails
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: gosec-sarif-results
        path: gosec-results.sarif
        retention-days: 7