feat: use go-spiffe SDK directly instead of spiffe-helper sidecar #729
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security Scans - Comprehensive security checks | |
| # | |
| # Jobs: | |
| # - Dependency Review (always) | |
| # - Shellcheck (shell scripts) | |
| # - YAML Lint (workflows, charts) | |
| # - Helm Lint (charts/) | |
| # - Hadolint (Dockerfiles) | |
| # - Trivy (filesystem + IaC) | |
| # - CodeQL (Go) | |
| # - Action Pinning (informational) | |
| # | |
| name: Security Scans | |
| on: | |
| pull_request: | |
| branches: [main] | |
| permissions: {} | |
| jobs: | |
| # ============================================================================ | |
| # Phase 0: Foundations | |
| # ============================================================================ | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| # TODO: Remove continue-on-error after enabling Dependency Graph in | |
| # repo Settings > Code security and analysis | |
| continue-on-error: true | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4 | |
| with: | |
| fail-on-severity: moderate | |
| deny-licenses: GPL-3.0, AGPL-3.0 | |
| comment-summary-in-pr: never | |
| shellcheck: | |
| name: Shell Script Lint | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install shellcheck | |
| run: sudo apt-get install -y shellcheck | |
| - name: Run shellcheck | |
| run: | | |
| SCRIPTS=$(find . -name "*.sh" -type f 2>/dev/null | grep -v ".git/" || true) | |
| if [ -z "$SCRIPTS" ]; then | |
| echo "No shell scripts found" | |
| exit 0 | |
| fi | |
| echo "Found scripts:" | |
| echo "$SCRIPTS" | |
| echo "" | |
| FAILED=0 | |
| for script in $SCRIPTS; do | |
| echo "Checking: $script" | |
| if ! shellcheck --severity=error "$script"; then | |
| FAILED=1 | |
| fi | |
| done | |
| if [ $FAILED -eq 1 ]; then | |
| echo "ERROR: Some scripts have shellcheck errors." | |
| exit 1 | |
| fi | |
| echo "All scripts passed shellcheck (error level)" | |
| # ============================================================================ | |
| # Phase A: Linting | |
| # ============================================================================ | |
| yamllint: | |
| name: YAML Lint | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install yamllint | |
| run: pip install yamllint==1.* | |
| - name: Create config | |
| run: | | |
| cat > .yamllint.yaml << 'EOF' | |
| extends: relaxed | |
| ignore: | | |
| charts/*/templates/ | |
| rules: | |
| line-length: | |
| max: 150 | |
| level: warning | |
| truthy: | |
| check-keys: false | |
| document-start: disable | |
| comments: | |
| min-spaces-from-content: 1 | |
| indentation: | |
| spaces: 2 | |
| indent-sequences: whatever | |
| EOF | |
| - name: Lint YAML files | |
| run: | | |
| yamllint -c .yamllint.yaml \ | |
| .github/workflows/ \ | |
| charts/ || true | |
| echo "" | |
| echo "=== Summary ===" | |
| yamllint -c .yamllint.yaml -f parsable \ | |
| .github/workflows/ charts/ > /tmp/yamllint_output.txt 2>&1 || true | |
| ERROR_COUNT=$(grep -c ":error:" /tmp/yamllint_output.txt 2>/dev/null || echo "0") | |
| echo "Errors: $ERROR_COUNT" | |
| if [ "$ERROR_COUNT" -gt 0 ] 2>/dev/null; then | |
| echo "ERROR: YAML files have syntax errors." | |
| exit 1 | |
| fi | |
| helm-lint: | |
| name: Helm Chart Lint | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: 'v3.14.0' | |
| - name: Lint Helm charts | |
| run: | | |
| for chart in charts/*/; do | |
| if [ -f "$chart/Chart.yaml" ]; then | |
| echo "Linting: $chart" | |
| # Informational only — don't fail on pre-existing chart issues | |
| helm lint "$chart" 2>&1 || true | |
| echo "" | |
| fi | |
| done | |
| - name: Install yq | |
| uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d # v4 | |
| - name: Guard — AuthBridge injection images must be version-pinned (no floating tags) | |
| # Catches a :latest / floating-tag regression at PR-review time rather than | |
| # mid-release (rossoctl/rossoctl#508). Positive assertion: every injection image | |
| # must carry a :vX.Y.Z tag, in BOTH the chart values and the compiled Go fallbacks | |
| # (config/defaults.go, which the platform-config ConfigMap overlays on top of — a | |
| # no-ConfigMap deploy would otherwise still inject :latest). | |
| run: | | |
| set -euo pipefail | |
| fail=0 | |
| for k in envoyProxy authbridge authbridgeLite proxyInit; do | |
| img=$(yq ".defaults.images.$k" charts/operator/values.yaml) | |
| if [[ ! "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]]; then | |
| echo "::error file=charts/operator/values.yaml::defaults.images.$k not version-pinned: $img" | |
| fail=1 | |
| fi | |
| done | |
| while IFS= read -r img; do | |
| if [[ ! "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]]; then | |
| echo "::error file=operator/internal/webhook/config/defaults.go::compiled default not version-pinned: $img" | |
| fail=1 | |
| fi | |
| done < <(grep -oE 'ghcr\.io/rossoctl/cortex/[a-z-]+:[^"]+' operator/internal/webhook/config/defaults.go) | |
| if [ "$fail" -ne 0 ]; then | |
| echo "::error::pin the flagged AuthBridge injection image(s) to a cortex release tag (rossoctl/rossoctl#508)" | |
| exit 1 | |
| fi | |
| echo "AuthBridge injection images are version-pinned OK (values.yaml + config/defaults.go)" | |
| # ============================================================================ | |
| # Phase B: Container/IaC Security | |
| # ============================================================================ | |
| hadolint: | |
| name: Dockerfile Lint (Hadolint) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Find Dockerfiles | |
| id: find-dockerfiles | |
| run: | | |
| DOCKERFILES=$(find . -name "Dockerfile*" -type f 2>/dev/null | grep -v ".git/" || true) | |
| if [ -z "$DOCKERFILES" ]; then | |
| echo "has_dockerfiles=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "Found Dockerfiles:" | |
| echo "$DOCKERFILES" | |
| echo "has_dockerfiles=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run Hadolint | |
| if: steps.find-dockerfiles.outputs.has_dockerfiles == 'true' | |
| uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0 | |
| with: | |
| dockerfile: "**/Dockerfile*" | |
| recursive: true | |
| failure-threshold: error | |
| # DL3007: Using latest tag, DL3008: Unpinned apt packages | |
| # DL3015: No --no-install-recommends, DL3059: Multiple consecutive RUN | |
| ignore: DL3007,DL3008,DL3015,DL3059 | |
| trivy-fs: | |
| name: Trivy Filesystem Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Dependency vulnerability scan (informational) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| severity: 'CRITICAL,HIGH' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| format: 'table' | |
| - name: IaC config scan (informational) | |
| # Informational until pre-existing K8s security issues are addressed | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: 'config' | |
| scan-ref: '.' | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| skip-dirs: 'operator/demos' | |
| exit-code: '0' | |
| format: 'table' | |
| # ============================================================================ | |
| # Phase C: Advanced Security | |
| # ============================================================================ | |
| codeql: | |
| name: CodeQL Analysis (Go) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 | |
| with: | |
| languages: go | |
| queries: security-extended | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4 | |
| with: | |
| category: "/language:go" | |
| action-pinning: | |
| name: Verify Action Pinning | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Check for unpinned GitHub Actions | |
| run: | | |
| echo "=== Checking for unpinned GitHub Actions ===" | |
| UNPINNED=$(grep -rh 'uses:' .github/workflows/ | grep -E 'uses:.*@' | grep -vE '@[0-9a-f]{40}' | sort -u || true) | |
| if [ -n "$UNPINNED" ]; then | |
| echo "::warning::Found actions not pinned to SHA commits:" | |
| echo "$UNPINNED" | |
| COUNT=$(echo "$UNPINNED" | wc -l | tr -d ' ') | |
| echo "Total unpinned actions: $COUNT" | |
| echo "NOTE: This check is informational." | |
| else | |
| echo "All actions are pinned to SHA commits!" | |
| fi | |
| exit 0 |