|
|
@@ -12,6 +12,7 @@ on:
|
|
|
- 'docker-compose*.yml'
|
|
|
- 'requirements.txt'
|
|
|
- 'frontend/package*.json'
|
|
|
+ - '.github/workflows/security.yml'
|
|
|
pull_request:
|
|
|
paths:
|
|
|
- 'backend/**'
|
|
|
@@ -20,6 +21,7 @@ on:
|
|
|
- 'docker-compose*.yml'
|
|
|
- 'requirements.txt'
|
|
|
- 'frontend/package*.json'
|
|
|
+ - '.github/workflows/security.yml'
|
|
|
workflow_dispatch:
|
|
|
# Allow manual trigger
|
|
|
|
|
|
@@ -73,7 +75,7 @@ jobs:
|
|
|
run: docker build -t bambuddy:security-scan .
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
- uses: aquasecurity/trivy-action@0.33.1
|
|
|
+ uses: aquasecurity/trivy-action@0.34.0
|
|
|
with:
|
|
|
image-ref: 'bambuddy:security-scan'
|
|
|
format: 'sarif'
|
|
|
@@ -89,7 +91,7 @@ jobs:
|
|
|
category: trivy
|
|
|
|
|
|
- name: Run Trivy for Dockerfile/IaC
|
|
|
- uses: aquasecurity/trivy-action@0.33.1
|
|
|
+ uses: aquasecurity/trivy-action@0.34.0
|
|
|
with:
|
|
|
scan-type: 'config'
|
|
|
scan-ref: '.'
|
|
|
@@ -228,8 +230,36 @@ jobs:
|
|
|
id: npm-audit
|
|
|
working-directory: frontend
|
|
|
run: |
|
|
|
- npm audit --json > npm-audit-results.json || echo "vulnerabilities_found=true" >> $GITHUB_OUTPUT
|
|
|
- npm audit --audit-level=high || true
|
|
|
+ npm audit --omit=dev --json > npm-audit-raw.json 2>&1 || true
|
|
|
+ # Filter audit results to only include actual project dependencies
|
|
|
+ # (npm audit sometimes reports vulnerabilities in the npm CLI itself)
|
|
|
+ node -e "
|
|
|
+ const fs = require('fs');
|
|
|
+ const results = JSON.parse(fs.readFileSync('npm-audit-raw.json', 'utf8'));
|
|
|
+ const depTree = JSON.parse(require('child_process').execSync(
|
|
|
+ 'npm ls --omit=dev --all --json 2>/dev/null', { encoding: 'utf8' }
|
|
|
+ ));
|
|
|
+ const prodDeps = new Set();
|
|
|
+ (function walk(obj) {
|
|
|
+ for (const [name, info] of Object.entries(obj.dependencies || {})) {
|
|
|
+ prodDeps.add(name);
|
|
|
+ walk(info);
|
|
|
+ }
|
|
|
+ })(depTree);
|
|
|
+ const vulns = results.vulnerabilities || {};
|
|
|
+ const filtered = {};
|
|
|
+ for (const [name, info] of Object.entries(vulns)) {
|
|
|
+ if (prodDeps.has(name)) filtered[name] = info;
|
|
|
+ }
|
|
|
+ results.vulnerabilities = filtered;
|
|
|
+ fs.writeFileSync('npm-audit-results.json', JSON.stringify(results, null, 2));
|
|
|
+ const count = Object.keys(filtered).length;
|
|
|
+ console.log(count > 0
|
|
|
+ ? count + ' production vulnerabilities found'
|
|
|
+ : 'No production vulnerabilities (filtered ' + Object.keys(vulns).length + ' npm-internal entries)');
|
|
|
+ if (count > 0) process.exit(1);
|
|
|
+ " || echo "vulnerabilities_found=true" >> $GITHUB_OUTPUT
|
|
|
+ npm audit --omit=dev --audit-level=high || true
|
|
|
|
|
|
- name: Upload audit results
|
|
|
if: always()
|
uefigs139
