vulnerability-scan.yml

name: "Security vulnerability scan"

on:
  schedule:
    - cron: "20 23 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  go:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - govulncheck
          - nancy
          - osv-scanner
    steps:
      - uses: actions/checkout@v4
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
          check-latest: true
      - name: Scan
        run: make scan-go-${{ matrix.target }}

  node:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - npm-audit
          - osv-scanner
    steps:
      - uses: actions/checkout@v4
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "lts/*"
      - name: Set up Go
        if: ${{ matrix.target == 'osv-scanner' }}
        uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Scan
        run: make scan-node-${{ matrix.target }}

  java_osv_scanner:
    name: "java (osv-scanner)"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: stable
      - name: Scan
        run: make scan-java-osv-scanner

  java_dependency_check:
    name: "java (dependency-check)"
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: java
    steps:
      - uses: actions/checkout@v4
      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          java-version: 21
          distribution: temurin
          cache: maven
      - name: Download dependencies
        run: mvn dependency:copy-dependencies -DincludeScope=runtime
      - name: Scan
        env:
          JAVA_HOME: /opt/jdk
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: fabric-gateway
          path: java/target/dependency
          format: HTML
          out: reports
          args: >
            --suppression java/dependency-suppression.xml
            --failOnCVSS 4
      - name: Archive dependency-check report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@v4
        with:
          name: dependency-check-report
          path: reports