mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-08-29 04:26:20 +00:00
Zohaib Hassnain
fd95639bdd
The pin was 5595ccaf..., but upstream has since moved the v4 tag to ff2f1c62.... The Verify Action Pins workflow flags this drift on every PR that touches any workflow file, regardless of whether that PR changed codeql.yml or defender-for-devops.yml. Verified the new SHA against the GitHub API directly (not just the CI error text) and confirmed .github/scripts/verify-action-pins.sh passes clean locally (40/40 action references OK, exit 0).
89 lines
3.7 KiB
YAML
89 lines
3.7 KiB
YAML
# This workflow uses actions that are not certified by GitHub.
|
|
# They are provided by a third-party and are governed by
|
|
# separate terms of service, privacy policy, and support
|
|
# documentation.
|
|
#
|
|
# Microsoft Security DevOps (MSDO) is a command line application which integrates static analysis tools into the development cycle.
|
|
# MSDO installs, configures and runs the latest versions of static analysis tools
|
|
# (including, but not limited to, SDL/security and compliance tools).
|
|
#
|
|
# The Microsoft Security DevOps action is currently in beta and runs on the windows-latest queue,
|
|
# as well as Windows self hosted agents. ubuntu-latest support coming soon.
|
|
#
|
|
# For more information about the action , check out https://github.com/microsoft/security-devops-action
|
|
#
|
|
# Please note this workflow do not integrate your GitHub Org with Microsoft Defender For DevOps. You have to create an integration
|
|
# and provide permission before this can report data back to azure.
|
|
# Read the official documentation here : https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github
|
|
|
|
name: "Microsoft Defender For Devops"
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
schedule:
|
|
- cron: '43 17 * * 6'
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
MSDO:
|
|
# currently only windows-latest is supported
|
|
runs-on: windows-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
|
|
with:
|
|
dotnet-version: |
|
|
5.0.x
|
|
6.0.x
|
|
- name: Run Microsoft Security DevOps
|
|
uses: microsoft/security-devops-action@08976cb623803b1b36d7112d4ff9f59eae704de0 # v1.12.0
|
|
id: msdo
|
|
with:
|
|
# checkov is intentionally excluded from this MSDO step.
|
|
# MSDO 0.215.0's guardian.cmd wrapper treats checkov's exit code 1
|
|
# (emitted whenever any violation is found, even below the active severity
|
|
# threshold) as a fatal "tool error" and breaks the build even when
|
|
# "Active results: 0" and "Found no breaking results." The .checkov.yaml
|
|
# soft-fail setting is never read by the guardian wrapper.
|
|
# IaC security scanning continues below in this same MSDO job identity.
|
|
# That preserves the existing GitHub code-scanning configuration while
|
|
# avoiding the guardian.cmd/checkov exit-code bug in the MSDO wrapper.
|
|
tools: eslint,templateanalyzer,terrascan
|
|
- name: Upload results to Security tab
|
|
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
|
|
with:
|
|
sarif_file: ${{ steps.msdo.outputs.sarifFile }}
|
|
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install Checkov
|
|
run: python -m pip install checkov==3.3.1
|
|
|
|
- name: Run Checkov
|
|
shell: pwsh
|
|
env:
|
|
PYTHONUTF8: "1"
|
|
run: |
|
|
New-Item -ItemType Directory -Force reports | Out-Null
|
|
checkov --directory . --framework kubernetes helm dockerfile github_actions secrets bicep arm --soft-fail --output sarif --output-file-path reports/checkov.sarif
|
|
if (-not (Test-Path reports/checkov.sarif)) {
|
|
$sarif = Get-ChildItem -Path reports -Recurse -Filter *.sarif | Select-Object -First 1
|
|
if ($null -eq $sarif) { throw "Checkov did not produce a SARIF file" }
|
|
Copy-Item $sarif.FullName reports/checkov.sarif
|
|
}
|
|
|
|
- name: Upload Checkov results to Security tab
|
|
uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
|
|
if: always()
|
|
with:
|
|
sarif_file: reports/checkov.sarif
|