devsecops.yaml

# DevSecOps Workflow Definition
# This workflow is triggered on every push to the repository
name: DevSecOps Workflow


on: push

# Environment variables used across multiple jobs
env:
  IMAGE_TAG: ghcr.io/${{ github.repository }}:unstable
  IMAGE_NAME: ghcr.io/${{ github.repository }}

jobs:
  # Secret scanning job to detect secrets in codebase
  secret-scanning:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4 # Check out the repository content to the runner
    - name: Run Gitleaks Scan
      # Running Gitleaks to scan the code for secrets
      run: |
        docker run --rm -v $(pwd):/code -u $(id -u):$(id -g) zricethezav/gitleaks:v8.18.1 -s /code detect -f sarif -r /code/gitleaks.sarif.json
    - name: Upload sarif file
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: gitleaks.sarif.json
        category: secret-scanning

  # Software Composition Analysis (SCA) to find vulnerabilities in project dependencies
  sca:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Trivy vulnerability scanner in fs mode
      # Running Trivy to scan the filesystem for vulnerabilities
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: "fs"
        scan-ref: "."
        severity: "CRITICAL,HIGH"
        format: "sarif"
        output: "trivy-results.sarif"
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: "trivy-results.sarif"
        category: "sca"

  # Static Application Security Testing (SAST) to identify security vulnerabilities in source code
  sast:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    - name: Run Semgrep
      # Running Semgrep for static code analysis to identify security issues
      uses: docker://returntocorp/semgrep
      with:
        args: semgrep scan /github/workspace --sarif -o /github/workspace/semgrep.sarif.json
    - name: Upload sarif file
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: semgrep.sarif.json
        category: sast
  # Docker image build job
  build-image:
    runs-on: ubuntu-latest
    outputs:
      image_path: ${{ steps.build_output.outputs.image_path }}
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    steps:
    - uses: actions/checkout@v4
    - name: Set IMAGE_TAG if tagged
      # Setting the image tag if the push is a tag push
      run: |
        echo "IMAGE_TAG=ghcr.io/${{ github.repository }}:${GITHUB_REF#refs/tags/}" > image-tag.txt
        export IMAGE_TAG=$(cat image-tag.txt)
        echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV
      if: startsWith(github.ref, 'refs/tags/')
    - name: Set IMAGE_TAG if not tagged
      run: |
        branch=${GITHUB_REF##*/}
        sha=${GITHUB_SHA::8}
        ts=$(date +%s)
        echo "ghcr.io/${{ github.repository }}:${branch}-${sha}-${ts}" > image-tag.txt
        export IMAGE_TAG=$(cat image-tag.txt)
        echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV
      if: github.ref == 'refs/heads/main'
    - name: Git describe
      id: ghd
      uses: proudust/gh-describe@v2
    - name: Build Docker image with Kaniko
      # Building the Docker image using Kaniko
      id: build_image
      uses: docker://gcr.io/kaniko-project/executor:v1.9.2
      with:
        args: --destination=${{ env.IMAGE_TAG }} --context=/github/workspace --build-arg "VERSION=${{ steps.ghd.outputs.describe }}" --dockerfile=/github/workspace/Dockerfile --no-push --tarPath /github/workspace/image.tar
    - name: Setup crane
      uses: imjasonh/setup-crane@v0.1
    - name: Use crane to get the digest
      run: crane digest --tarball=image.tar > digest.txt
    - name: Upload artifact
      # Uploading the built Docker image as an artifact
      uses: actions/upload-artifact@v4
      with:
        name: docker-image
        path: image.tar
    - name: Upload digest
      # Uploading the built Docker image digest as an artifact
      uses: actions/upload-artifact@v4
      with:
        name: digest
        path: digest.txt
    - name: Upload image tag
      uses: actions/upload-artifact@v4
      with:
        name: image-tag
        path: image-tag.txt


  # Image scanning job to detect vulnerabilities in the built Docker image
  image-scanning:
    needs: build-image
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    steps:
    - uses: actions/checkout@v4
    - uses: actions/download-artifact@v4
      with:
        name: docker-image
        path: .
    - name: Run Trivy vulnerability scanner in tarball mode
      # Running Trivy to scan the Docker image for vulnerabilities
      uses: aquasecurity/trivy-action@master
      with:
        input: /github/workspace/image.tar
        severity: "CRITICAL,HIGH"
        format: "sarif"
        output: "trivy-results.sarif"
    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: "trivy-results.sarif"
        category: "image-scanning"

  # Publish job to push the Docker image to a registry
  publish:
    needs: [build-image, image-scanning, secret-scanning, sca, sast]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    steps:
    - uses: actions/download-artifact@v4
      with:
        name: docker-image
        path: .
    - uses: actions/download-artifact@v4
      with:
        name: image-tag
        path: .
    - name: set IMAGE_TAG env
      run: |
        export IMAGE_TAG=$(cat image-tag.txt)
        echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV
    - uses: imjasonh/setup-crane@v0.1
    - name: Set IMAGE_TAG if tagged
      # Setting the image tag if the push is a tag push
      run: echo "IMAGE_TAG=ghcr.io/${{ github.repository }}:${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
      if: startsWith(github.ref, 'refs/tags/')
    - name: Push Docker image to GitHub image Registry
      # Pushing the Docker image to GitHub Container Registry
      run: crane push image.tar ${{ env.IMAGE_TAG }}

  sign-image:
    runs-on: ubuntu-latest
    needs: publish
    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
    steps:
    - name: cosign-installer
      uses: sigstore/cosign-installer@v3.3.0
      with:
        cosign-release: 'v2.2.3' # optional
    - name: Download digest
      uses: actions/download-artifact@v4
      with:
        name: digest
        path: .
    - name: Download image tag
      uses: actions/download-artifact@v4
      with:
        name: image-tag
        path: .
    - name: Read digest and image tag from file
      run: |
        export IMAGE_DIGEST=$(cat digest.txt)
        echo "IMAGE_DIGEST=$IMAGE_DIGEST" >> $GITHUB_ENV
        export IMAGE_TAG=$(cat image-tag.txt)
        echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_ENV
    - name: Login to GitHub Container Registry
      uses: docker/login-action@v2.1.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - name: Write signing key to disk (only needed for `cosign sign --key`)
      run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
    - name: Sign the published Docker image
      env:
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      run: cosign sign --yes --key cosign.key "${{ env.IMAGE_TAG }}@${{ env.IMAGE_DIGEST }}"