Security #78
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| # Hebdomadaire : capte les nouvelles advisories sur des dépendances figées. | |
| - cron: "0 6 * * 1" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: security-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| secrets: | |
| name: Secrets (gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # historique complet pour scanner tous les commits | |
| - name: Scan | |
| run: | | |
| VER=8.18.4 | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" \ | |
| | tar -xz gitleaks | |
| ./gitleaks detect --source . --config .gitleaks.toml --redact --verbose | |
| deps: | |
| name: Vulns dépendances (osv-scanner) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Scan des lockfiles (Cargo.lock + package-lock.json) | |
| run: | | |
| curl -sSfL "https://github.com/google/osv-scanner/releases/download/v1.9.2/osv-scanner_linux_amd64" -o osv-scanner | |
| chmod +x osv-scanner | |
| ./osv-scanner --recursive --skip-git . | |
| cargo-audit: | |
| name: Advisories Rust (cargo-audit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - run: cargo install cargo-audit --locked | |
| - run: cargo audit | |
| sast: | |
| name: SAST (Semgrep) | |
| runs-on: ubuntu-latest | |
| container: semgrep/semgrep | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Analyse statique (règles sécurité + secrets + JS/TS) | |
| run: > | |
| semgrep scan --error --skip-unknown-extensions | |
| --config p/security-audit | |
| --config p/secrets | |
| --config p/javascript | |
| --config p/typescript | |
| # CodeQL (SAST GitHub) — à ajouter quand le « Code scanning » sera activé : | |
| # Settings → Code security (gratuit sur dépôt public ; GitHub Advanced Security sur privé). | |
| # Le SAST est déjà couvert par Semgrep ci-dessus en attendant. | |
| # codeql: | |
| # name: CodeQL (JS/TS) | |
| # runs-on: ubuntu-latest | |
| # permissions: { contents: read, security-events: write, actions: read } | |
| # steps: | |
| # - uses: actions/checkout@v4 | |
| # - uses: github/codeql-action/init@v3 | |
| # with: { languages: javascript-typescript } | |
| # - uses: github/codeql-action/analyze@v3 |