OpenShell/.github/workflows/security-scan.yml at main · simount/OpenShell · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: Security Scan

on:
  workflow_dispatch:
    inputs:
      candidate_ref:
        description: Release tag to scan
        required: true
        type: string
      fail-on-static-findings:
        description: Fail when CodeQL, Trivy, or Zizmor reports HIGH/CRITICAL findings
        default: true
        type: boolean
      images:
        description: Newline-separated image references for Trivy
        default: ""
        type: string
      charts:
        description: Newline-separated packaged Helm chart OCI references for Trivy
        default: ""
        type: string
  workflow_call:
    inputs:
      candidate_ref:
        description: Release tag to scan
        required: true
        type: string
      fail-on-static-findings:
        description: Fail when CodeQL, Trivy, or Zizmor reports HIGH/CRITICAL findings
        default: true
        type: boolean
      images:
        description: Newline-separated image references for Trivy
        default: ""
        type: string
      charts:
        description: Newline-separated packaged Helm chart OCI references for Trivy
        default: ""
        type: string
    secrets:
      CACHIX_AUTH_TOKEN:
        required: false

permissions:
  contents: read

# Only the finding threshold is overridable; execution failures remain fatal.
jobs:
  codeql:
    name: CodeQL
    uses: ./.github/workflows/codeql.yml
    permissions:
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}

  trivy:
    name: Trivy
    uses: ./.github/workflows/trivy-scan.yml
    permissions:
      contents: read
      packages: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}
      severity: HIGH,CRITICAL
      ignore-unfixed: false
      images: ${{ inputs.images }}
      charts: ${{ inputs.charts }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}

  cargo-deny:
    name: Cargo Deny
    uses: ./.github/workflows/cargo-deny.yml
    permissions:
      contents: read
      packages: read
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      advisories-only: true

  workflow-security:
    name: Actionlint and Zizmor
    uses: ./.github/workflows/workflow-security.yml
    permissions:
      contents: read
      security-events: write
    with:
      candidate_ref: ${{ inputs.candidate_ref }}
      fail-on-findings: ${{ inputs.fail-on-static-findings }}
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}