Story Crater Bot
7437078f23
Use proper Forgejo variables: gitea.server_url, gitea.repository Construct CLONE_URL correctly: https://user:token@host/repo.git Use bash parameter expansion to strip https:// prefix Removes invalid Forgejo filter syntax (| replace)
126 lines
4.4 KiB
YAML
126 lines
4.4 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- develop
|
|
paths:
|
|
- 'k8s/**'
|
|
pull_request:
|
|
paths:
|
|
- 'k8s/**'
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: docker
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
REPO_URL="${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
CLONE_URL="https://${{ secrets.CI_RUNNER }}:${{ secrets.CI_RUNNER_SECRET }}@${REPO_URL#https://}"
|
|
git clone --depth 1 "$CLONE_URL" .
|
|
cd ${GITHUB_WORKSPACE}
|
|
git fetch origin main
|
|
git checkout main
|
|
|
|
- name: Install Tools
|
|
run: |
|
|
apt-get update && apt-get install -y \
|
|
python3-pip \
|
|
curl
|
|
|
|
# Install Trivy (vulnerability scanner)
|
|
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
# Install Polaris (K8s security audit)
|
|
curl -L https://github.com/FairwindsOps/polaris/releases/latest/download/polaris-linux-amd64 -o /usr/local/bin/polaris
|
|
chmod +x /usr/local/bin/polaris
|
|
|
|
- name: Trivy - Scan Dockerfile (if present)
|
|
run: |
|
|
if find . -name "Dockerfile" 2>/dev/null | grep -v node_modules | head -1 | grep -q .; then
|
|
echo "=== Scanning Dockerfiles with Trivy ==="
|
|
find . -name "Dockerfile" -not -path "*/node_modules/*" -exec trivy config {} \;
|
|
else
|
|
echo "No Dockerfiles found"
|
|
fi
|
|
|
|
- name: Trivy - Scan Helm Charts
|
|
run: |
|
|
if find k8s -name "Chart.yaml" 2>/dev/null | head -1 | grep -q .; then
|
|
echo "=== Scanning Helm charts with Trivy ==="
|
|
find k8s -name "Chart.yaml" -exec dirname {} \; | while read chart; do
|
|
echo "Scanning $chart..."
|
|
trivy config "$chart" || true
|
|
done
|
|
else
|
|
echo "No Helm charts found"
|
|
fi
|
|
|
|
- name: Polaris - K8s Security Audit
|
|
run: |
|
|
echo "=== Running Polaris K8s security audit ==="
|
|
polaris audit --audit-path /tmp/polaris-audit.json k8s/ || true
|
|
|
|
if [ -f /tmp/polaris-audit.json ]; then
|
|
echo "Security issues found:"
|
|
jq '.results[] | select(.pass == false)' /tmp/polaris-audit.json || true
|
|
fi
|
|
|
|
- name: Check for Secrets in Code
|
|
run: |
|
|
echo "=== Scanning for hardcoded secrets ==="
|
|
SECRETS_FOUND=0
|
|
|
|
# Check for common secret patterns
|
|
for pattern in "password:" "secret:" "token:" "api_key:" "apikey:" "private_key:" "privatekey:"; do
|
|
if grep -r "$pattern" k8s/ --include="*.yaml" --include="*.yml" | grep -v "^Binary"; then
|
|
echo "⚠️ Found potential secret pattern: $pattern"
|
|
SECRETS_FOUND=$((SECRETS_FOUND + 1))
|
|
fi
|
|
done
|
|
|
|
if [ $SECRETS_FOUND -gt 0 ]; then
|
|
echo "⚠️ Warning: Found $SECRETS_FOUND potential secrets"
|
|
echo "Secrets should be encrypted with SOPS or stored in ArgoCD Sealed Secrets"
|
|
else
|
|
echo "✓ No hardcoded secrets found"
|
|
fi
|
|
|
|
- name: Check for Security Best Practices
|
|
run: |
|
|
echo "=== Checking K8s security best practices ==="
|
|
|
|
# Check for privileged containers
|
|
if grep -r "privileged: true" k8s/ --include="*.yaml" --include="*.yml"; then
|
|
echo "⚠️ Found privileged containers"
|
|
fi
|
|
|
|
# Check for hostNetwork
|
|
if grep -r "hostNetwork: true" k8s/ --include="*.yaml" --include="*.yml"; then
|
|
echo "⚠️ Found hostNetwork usage"
|
|
fi
|
|
|
|
# Check for missing resource limits
|
|
echo "Checking for missing resource requests/limits..."
|
|
MISSING=0
|
|
find k8s -name "*.yaml" -o -name "*.yml" | while read file; do
|
|
if grep -q "kind: Deployment\|kind: StatefulSet\|kind: DaemonSet" "$file"; then
|
|
if ! grep -q "resources:" "$file"; then
|
|
echo "⚠️ $file: Missing resource requests/limits"
|
|
MISSING=$((MISSING + 1))
|
|
fi
|
|
fi
|
|
done
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
echo "=== Security Scan Summary ==="
|
|
echo "✓ Dockerfiles scanned"
|
|
echo "✓ Helm charts scanned"
|
|
echo "✓ K8s manifests audited"
|
|
echo "✓ Secrets check completed"
|
|
echo "✓ Best practices verified"
|