feat(auth): the keychain setting starts doing something, on every platform including Windows #1523
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| # Weekly Monday 6am UTC | |
| - cron: '0 6 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| packages: read | |
| jobs: | |
| govulncheck: | |
| name: Go Vulnerability Check | |
| runs-on: ubuntu-latest | |
| # Skip on release-please PRs (deterministic version bumps don't need | |
| # a fresh vuln scan — the underlying go.mod was already gated on the | |
| # PR that introduced the change). Schedule + workflow_dispatch keep | |
| # running for drift detection. | |
| if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please--') | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck (root) | |
| run: govulncheck ./... | |
| - name: Run govulncheck (operator) | |
| # Operator is a separate Go module with its own go.sum, so | |
| # govulncheck has to be re-run inside it. The root scan does NOT | |
| # transitively cover the operator's dependencies. | |
| working-directory: operator | |
| run: govulncheck ./... | |
| gosec: | |
| name: Go Security Analysis | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please--') | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Install gosec | |
| run: go install github.com/securego/gosec/v2/cmd/gosec@latest | |
| - name: Run gosec (root) | |
| # Keep the artefact named gosec-results.sarif — there is a Code | |
| # Scanning configuration on the repo that watches that exact | |
| # filename. Renaming would surface "1 configuration not found". | |
| run: gosec -exclude-generated -fmt sarif -out gosec-results.sarif ./... || true | |
| - name: Run gosec (operator) | |
| working-directory: operator | |
| run: gosec -exclude-generated -fmt sarif -out gosec-operator.sarif ./... || true | |
| - name: Upload SARIF results (root) | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: gosec-results.sarif | |
| - name: Upload SARIF results (operator) | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: operator/gosec-operator.sarif | |
| category: gosec-operator | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/dependency-review-action@v5 | |
| with: | |
| fail-on-severity: high | |
| deny-licenses: GPL-3.0, AGPL-3.0 | |
| trivy-image-chatcli: | |
| name: Trivy — ChatCLI Image | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please--') | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build ChatCLI image for scanning | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: false | |
| load: true | |
| no-cache: true | |
| tags: chatcli:scan | |
| # SARIF upload — informational, all severities, never blocks | |
| - name: Trivy scan (SARIF report) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: chatcli:scan | |
| format: sarif | |
| output: trivy-chatcli.sarif | |
| exit-code: '0' | |
| - name: Upload Trivy SARIF results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: trivy-chatcli.sarif | |
| category: trivy-chatcli | |
| # Gate — only fails on fixable HIGH/CRITICAL OS vulns (Go vulns covered by govulncheck) | |
| - name: Trivy gate (fixable HIGH/CRITICAL) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: chatcli:scan | |
| format: table | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| trivyignores: .trivyignore.yaml | |
| scanners: vuln | |
| exit-code: '1' | |
| trivy-image-operator: | |
| name: Trivy — Operator Image | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'pull_request' || !startsWith(github.head_ref, 'release-please--') | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build Operator image for scanning | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: ./operator/Dockerfile | |
| push: false | |
| load: true | |
| no-cache: true | |
| tags: chatcli-operator:scan | |
| # SARIF upload — informational, all severities, never blocks | |
| - name: Trivy scan (SARIF report) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: chatcli-operator:scan | |
| format: sarif | |
| output: trivy-operator.sarif | |
| exit-code: '0' | |
| - name: Upload Trivy SARIF results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: trivy-operator.sarif | |
| category: trivy-operator | |
| # Gate — only fails on fixable HIGH/CRITICAL OS vulns (Go vulns covered by govulncheck) | |
| - name: Trivy gate (fixable HIGH/CRITICAL) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: chatcli-operator:scan | |
| format: table | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| trivyignores: .trivyignore.yaml | |
| scanners: vuln | |
| exit-code: '1' |