|
name: "Security" |
|
|
|
on: |
|
push: |
|
branches: [master] |
|
pull_request: |
|
branches: [master] |
|
schedule: |
|
- cron: "0 6 * * 1" |
|
|
|
concurrency: |
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} |
|
cancel-in-progress: true |
|
|
|
jobs: |
|
codeql: |
|
name: CodeQL Analysis |
|
runs-on: ubuntu-latest |
|
timeout-minutes: 30 |
|
permissions: |
|
actions: read |
|
contents: read |
|
security-events: write |
|
|
|
strategy: |
|
fail-fast: false |
|
matrix: |
|
language: ["python", "javascript-typescript"] |
|
|
|
steps: |
|
- name: Checkout repository |
|
uses: actions/checkout@v4 |
|
|
|
- name: Initialize CodeQL |
|
uses: github/codeql-action/init@v4 |
|
with: |
|
languages: ${{ matrix.language }} |
|
|
|
- name: Autobuild |
|
uses: github/codeql-action/autobuild@v4 |
|
|
|
- name: Perform CodeQL Analysis |
|
uses: github/codeql-action/analyze@v4 |
|
with: |
|
category: "/language:${{ matrix.language }}" |
|
|
|
safety: |
|
name: Dependency Security Scan |
|
runs-on: ubuntu-latest |
|
permissions: |
|
contents: read |
|
|
|
steps: |
|
- name: Checkout repository |
|
uses: actions/checkout@v4 |
|
|
|
- name: Set up Python |
|
uses: actions/setup-python@v5 |
|
with: |
|
python-version: "3.12" |
|
cache: "pip" |
|
cache-dependency-path: pyproject.toml |
|
|
|
- name: Install project dependencies and safety |
|
run: | |
|
pip install safety |
|
pip install -e ".[ci]" || pip install -e . |
|
|
|
- name: Run safety scan |
|
continue-on-error: true |
|
run: safety scan --output json |
|
|
|
govulncheck: |
|
name: Go Vulnerability Check (${{ matrix.module }}) |
|
runs-on: ubuntu-latest |
|
timeout-minutes: 15 |
|
permissions: |
|
contents: read |
|
|
|
strategy: |
|
fail-fast: false |
|
matrix: |
|
include: |
|
- module: go-feature-server |
|
working-directory: . |
|
go-version-file: go.mod |
|
needs-protos: true |
|
- module: feast-operator |
|
working-directory: infra/feast-operator |
|
go-version-file: infra/feast-operator/go.mod |
|
needs-protos: false |
|
|
|
steps: |
|
- name: Checkout repository |
|
uses: actions/checkout@v4 |
|
|
|
- name: Set up Go |
|
uses: actions/setup-go@v5 |
|
with: |
|
go-version-file: ${{ matrix.go-version-file }} |
|
|
|
- name: Compile Go protobuf files |
|
if: matrix.needs-protos |
|
run: make compile-protos-go |
|
|
|
- name: Run govulncheck |
|
continue-on-error: true |
|
uses: golang/govulncheck-action@v1 |
|
with: |
|
work-dir: ${{ matrix.working-directory }} |
|
go-package: ./... |
|
repo-checkout: false |