Skip to content

Commit baa4aaf

Browse files
mrz1836mrz1836
committed
feat(ci): enhance security scanning with granular controls
- Split ENABLE_SECURITY_SCANS into individual tool flags - Add separate controls for nancy, govulncheck, and gitleaks - Update security workflow with enhanced vulnerability scanning
1 parent f4a4752 commit baa4aaf

File tree

2 files changed

+70
-3
lines changed

2 files changed

+70
-3
lines changed

‎.github/.env.shared‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,14 @@ SECONDARY_RUNNER=ubuntu-24.04 # Set identical to PRIMARY_RUNNER if you
3838
# ───────────────────────────────────────────────────────────────────────────────
3939
# ENV: Feature Flags
4040
# ───────────────────────────────────────────────────────────────────────────────
41-
ENABLE_BENCHMARKS=true # Enable benchmark tests (runs make bench)
41+
ENABLE_BENCHMARKS=true # Enable benchmark tests (runs make bench) (this needs more work before it can be enabled)
4242
ENABLE_CODE_COVERAGE=true # Enable code coverage reporting (upload to Codecov)
4343
ENABLE_FUZZ_TESTING=true # Enable fuzz running tests (requires Go 1.18+)
4444
ENABLE_GO_LINT=true # Enable Go code linting steps (golangci-lint)
4545
ENABLE_RACE_DETECTION=true # Enable Go's race detector in tests (-race flag)
46-
ENABLE_SECURITY_SCANS=true # Enable tools like gitleaks, govulncheck, nancy
46+
ENABLE_SECURITY_SCAN_NANCY=true # Enable Nancy dependency vulnerability checks
47+
ENABLE_SECURITY_SCAN_GOVULNCHECK=true # Enable govulncheck Go vulnerability scanning (Issue with https://pkg.go.dev/vuln/GO-2024-3218)
48+
ENABLE_SECURITY_SCAN_GITLEAKS=true # Enable Gitleaks secret scanning
4749
ENABLE_STATIC_ANALYSIS=true # Enable static analysis jobs (go vet)
4850
ENABLE_VERBOSE_TEST_OUTPUT=false # Enable verbose output for test runs (can slow down CI)
4951
ENABLE_YAML_LINT=true # Enable YAML format validation (prettier with editorconfig)

‎.github/workflows/fortress-security-scans.yml‎

Lines changed: 66 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,21 @@ on:
1717
description: "JSON string of environment variables"
1818
required: true
1919
type: string
20+
enable-nancy:
21+
description: "Enable Nancy security scan"
22+
required: false
23+
type: boolean
24+
default: true
25+
enable-govulncheck:
26+
description: "Enable govulncheck security scan"
27+
required: false
28+
type: boolean
29+
default: true
30+
enable-gitleaks:
31+
description: "Enable Gitleaks security scan"
32+
required: false
33+
type: boolean
34+
default: true
2035
primary-runner:
2136
description: "Primary runner OS"
2237
required: true
@@ -43,6 +58,7 @@ jobs:
4358
ask-nancy:
4459
name: 🛡️ Ask Nancy (Dependency Checks)
4560
runs-on: ${{ inputs.primary-runner }}
61+
if: ${{ inputs.enable-nancy }}
4662
steps:
4763
# ————————————————————————————————————————————————————————————————
4864
# Parse environment variables
@@ -124,6 +140,7 @@ jobs:
124140
govulncheck:
125141
name: 🔐 Run govulncheck (Vulnerability Scan)
126142
runs-on: ${{ inputs.primary-runner }}
143+
if: ${{ inputs.enable-govulncheck }}
127144
steps:
128145
# ————————————————————————————————————————————————————————————————
129146
# Parse environment variables
@@ -229,7 +246,7 @@ jobs:
229246
gitleaks:
230247
name: 🕵️ Run Gitleaks (Secret Scan)
231248
runs-on: ${{ inputs.primary-runner }}
232-
if: github.event.pull_request.head.repo.full_name == github.repository
249+
if: ${{ inputs.enable-gitleaks }}
233250
steps:
234251
# ————————————————————————————————————————————————————————————————
235252
# Parse environment variables
@@ -243,6 +260,38 @@ jobs:
243260
echo "$key=$value" >> $GITHUB_ENV
244261
done
245262
263+
# ————————————————————————————————————————————————————————————————
264+
# Check repository security conditions
265+
# ————————————————————————————————————————————————————————————————
266+
- name: 🔍 Check repository security conditions
267+
id: repo-check
268+
env:
269+
GITHUB_EVENT_NAME: ${{ github.event_name }}
270+
GITHUB_ACTOR: ${{ github.actor }}
271+
GITHUB_REPOSITORY: ${{ github.repository }}
272+
GITHUB_HEAD_REF: ${{ github.head_ref }}
273+
PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
274+
run: |
275+
echo "🔍 Checking repository security conditions..."
276+
echo "Event Name: $GITHUB_EVENT_NAME"
277+
echo "Actor: $GITHUB_ACTOR"
278+
echo "Repository: $GITHUB_REPOSITORY"
279+
echo "Head Ref: $GITHUB_HEAD_REF"
280+
281+
# For workflow_call, we typically trust the calling workflow from the same repo
282+
# For pull_request events, check if head repo matches base repo
283+
if [[ "$GITHUB_EVENT_NAME" == "workflow_call" ]]; then
284+
echo "✅ Workflow call from same repository - security scans allowed"
285+
echo "is_same_repo=true" >> $GITHUB_OUTPUT
286+
elif [[ "$PR_HEAD_REPO" == "$GITHUB_REPOSITORY" ]] || [[ -z "$PR_HEAD_REPO" ]]; then
287+
echo "✅ Same repository or push event - security scans allowed"
288+
echo "is_same_repo=true" >> $GITHUB_OUTPUT
289+
else
290+
echo "⚠️ Fork detected - skipping secret-sensitive scans for security"
291+
echo "PR Head Repo: $PR_HEAD_REPO"
292+
echo "is_same_repo=false" >> $GITHUB_OUTPUT
293+
fi
294+
246295
# ————————————————————————————————————————————————————————————————
247296
# Checkout code and set up Go environment
248297
# ————————————————————————————————————————————————————————————————
@@ -252,6 +301,7 @@ jobs:
252301
fetch-depth: 0 # Fetch all history so Gitleaks can scan commits
253302

254303
- name: 🔍 Run gitleaks scan
304+
if: steps.repo-check.outputs.is_same_repo == 'true'
255305
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v8.27.2
256306
env:
257307
GITHUB_TOKEN: ${{ secrets.github-token }}
@@ -263,6 +313,7 @@ jobs:
263313
GITLEAKS_VERSION: ${{ env.GITLEAKS_VERSION }}
264314

265315
- name: 📊 Job Summary
316+
if: steps.repo-check.outputs.is_same_repo == 'true'
266317
run: |
267318
echo "## 🕵️ Gitleaks Secret Scan Summary" >> $GITHUB_STEP_SUMMARY
268319
echo "" >> $GITHUB_STEP_SUMMARY
@@ -274,3 +325,17 @@ jobs:
274325
echo "| **Result** | ✅ No secrets detected (see logs for details) |" >> $GITHUB_STEP_SUMMARY
275326
echo "" >> $GITHUB_STEP_SUMMARY
276327
echo "🎯 **Secret scan completed successfully.**" >> $GITHUB_STEP_SUMMARY
328+
329+
- name: 📊 Fork Security Notice
330+
if: steps.repo-check.outputs.is_same_repo == 'false'
331+
run: |
332+
echo "## 🕵️ Gitleaks Secret Scan Summary" >> $GITHUB_STEP_SUMMARY
333+
echo "" >> $GITHUB_STEP_SUMMARY
334+
echo "| 🔒 Security Details | ⚠️ Status |" >> $GITHUB_STEP_SUMMARY
335+
echo "|---|---|" >> $GITHUB_STEP_SUMMARY
336+
echo "| **Tool** | Gitleaks |" >> $GITHUB_STEP_SUMMARY
337+
echo "| **Fork Detected** | ${{ github.event.pull_request.head.repo.full_name || 'N/A (not a PR event)' }} |" >> $GITHUB_STEP_SUMMARY
338+
echo "| **Base Repository** | ${{ github.repository }} |" >> $GITHUB_STEP_SUMMARY
339+
echo "| **Result** | ⚠️ Skipped for security (fork cannot access secrets) |" >> $GITHUB_STEP_SUMMARY
340+
echo "" >> $GITHUB_STEP_SUMMARY
341+
echo "🔒 **Secret scanning was skipped because this PR comes from a fork. This is a security feature to prevent secret exposure.**" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)