Security Scanning #45

	name: Security Scanning

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main, develop]
	schedule:
	# Run weekly on Monday at 2 AM UTC
	- cron: "0 2 * * 1"

	permissions:
	contents: read
	security-events: write
	actions: read

	jobs:
	vulnerability-scan:
	name: Vulnerability Scanning
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: "1.24"
	cache: true

	- name: Install dependencies
	run: go mod download

	- name: Run Govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	govulncheck ./...

	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@v4
	- name: Dependency Review
	uses: actions/dependency-review-action@v4
	with:
	fail-on-severity: moderate
	allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC
	deny-licenses: GPL-2.0, GPL-3.0, AGPL-1.0, AGPL-3.0

	secret-scanning:
	name: Secret Scanning
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: TruffleHog Secret Scanning
	uses: trufflesecurity/trufflehog@main
	with:
	extra_args: --results=verified,unknown

	gosec-analysis:
	name: Gosec Security Scanner
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version: "1.24"
	cache: true

	- name: Install dependencies
	run: go mod download

	- name: Run Gosec Security Scanner
	uses: securego/gosec@master
	with:
	args: -exclude=G104,G107,G204,G301,G304,G306 ./...

Navigation Menu