Skip to content

Security Audit

Security Audit #710

Workflow file for this run

name: "Security Audit"
on:
push:
branches: [ develop, master ]
pull_request:
branches: [ develop ]
schedule:
- cron: '23 4 * * 1'
jobs:
codeql:
name: CodeQL
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
env:
JAVA_DISTRIBUTION: temurin
JAVA_VERSION: 21
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Java
uses: actions/setup-java@v4
with:
distribution: ${{ env.JAVA_DISTRIBUTION }}
java-version: ${{ env.JAVA_VERSION }}
cache: 'maven'
- name: Verify Maven and Java
run: |
mvn --version
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: 'java'
- name: Build package
run: |
mvn --quiet -B -U --fail-fast -DskipTests package
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
snyk:
name: Snyk (Maven)
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Perform Snyk Check (Maven)
uses: snyk/actions/maven@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=critical
snyk-docker:
name: Snyk (Docker)
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
env:
PUBLIC_IMAGE: fairdata/fairdatapoint
TAG_DEVELOP: develop
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Docker build
run: |
docker pull $PUBLIC_IMAGE:$TAG_DEVELOP
docker build --cache-from $PUBLIC_IMAGE:$TAG_DEVELOP -t fdp:snyk-test -f Dockerfile.build .
- name: Perform Snyk Check (Docker)
uses: snyk/actions/docker@master
continue-on-error: true
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
image: fdp:snyk-test
args: --severity-threshold=critical