From 64f26e76f690c6c9778b045c9d2cfd54693fb8e1 Mon Sep 17 00:00:00 2001 From: shuaiplus <2327005759@qq.com> Date: Tue, 30 Jun 2026 13:05:04 +0800 Subject: [PATCH] chore: add security automation workflows --- .github/dependabot.yml | 29 ++++ .github/workflows/codeql.yml | 44 ++++++ .github/workflows/security-extra.yml | 199 +++++++++++++++++++++++++++ 3 files changed, 272 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/security-extra.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..ffedab4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +version: 2 + +updates: + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "05:00" + timezone: "Asia/Shanghai" + open-pull-requests-limit: 5 + groups: + npm-minor-and-patch: + update-types: + - "minor" + - "patch" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "05:10" + timezone: "Asia/Shanghai" + open-pull-requests-limit: 5 + groups: + github-actions: + patterns: + - "*" \ No newline at end of file diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..fb30230 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,44 @@ +name: "CodeQL Advanced" + +on: + push: + branches: + - "**" + +permissions: + contents: read + actions: read + security-events: write + packages: read + +jobs: + analyze: + name: CodeQL Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + include: + - language: actions + build-mode: none + - language: javascript-typescript + build-mode: none + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Initialize CodeQL + uses: github/codeql-action/init@v4 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + queries: security-extended,security-and-quality + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v4 + with: + category: "/language:${{ matrix.language }}" \ No newline at end of file diff --git a/.github/workflows/security-extra.yml b/.github/workflows/security-extra.yml new file mode 100644 index 0000000..6bb9015 --- /dev/null +++ b/.github/workflows/security-extra.yml @@ -0,0 +1,199 @@ +name: "Extra Security Scan" + +on: + push: + branches: + - "**" + +permissions: + contents: read + +jobs: + gitleaks: + name: Gitleaks Secret Scan + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - name: Checkout full history + uses: actions/checkout@v7 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Run Gitleaks + uses: gitleaks/gitleaks-action@v3 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITLEAKS_ENABLE_SUMMARY: "true" + GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "true" + # 如果仓库属于 GitHub Organization，需要在 Settings -> Secrets 里加 GITLEAKS_LICENSE + # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} + + osv: + name: OSV Dependency Scan + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 + + permissions: + contents: read + actions: read + security-events: write + + with: + scan-args: |- + --recursive + ./ + upload-sarif: true + fail-on-vuln: true + + pnpm-audit: + name: pnpm audit + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Setup Node.js + uses: actions/setup-node@v6 + with: + node-version: 22 + + - name: Run pnpm audit + shell: bash + run: | + if [ ! -f pnpm-lock.yaml ]; then + echo "pnpm-lock.yaml not found, skip pnpm audit." + exit 0 + fi + + corepack enable + corepack prepare pnpm@10 --activate + pnpm audit --audit-level=high + + semgrep: + name: Semgrep CE Scan + runs-on: ubuntu-latest + + permissions: + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Run Semgrep CE + shell: bash + run: | + docker run --rm \ + -v "${PWD}:/src" \ + -w /src \ + semgrep/semgrep:latest \ + semgrep scan --config p/default --sarif --output semgrep.sarif . || true + + if [ ! -f semgrep.sarif ]; then + cat > semgrep.sarif <<'EOF' + { + "version": "2.1.0", + "$schema": "https://json.schemastore.org/sarif-2.1.0.json", + "runs": [ + { + "tool": { + "driver": { + "name": "Semgrep", + "informationUri": "https://semgrep.dev", + "rules": [] + } + }, + "results": [] + } + ] + } + EOF + fi + + - name: Upload Semgrep SARIF + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: semgrep.sarif + category: semgrep + + actionlint: + name: GitHub Actions Syntax Scan + runs-on: ubuntu-latest + + permissions: + contents: read + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Run actionlint + shell: bash + run: | + docker run --rm \ + -v "${PWD}:/repo" \ + -w /repo \ + rhysd/actionlint:latest + + zizmor: + name: GitHub Actions Security Scan + runs-on: ubuntu-latest + + permissions: + contents: read + actions: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@v0.5.7 + with: + persona: auditor + min-severity: medium + min-confidence: medium + + scorecard: + name: OpenSSF Scorecard + runs-on: ubuntu-latest + + permissions: + contents: read + security-events: write + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: Run OpenSSF Scorecard + uses: ossf/scorecard-action@v2.4.3 + with: + results_file: scorecard.sarif + results_format: sarif + publish_results: false + + - name: Upload Scorecard SARIF + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: scorecard.sarif + category: openssf-scorecard \ No newline at end of file