infra-security-scan.yml

on:
  workflow_call:
    inputs:
      disable-sudo:
        type: boolean
        default: true
      egress-policy-allowlist:
        type: string
        default: ""
      enable-comments:
        type: boolean
        default: true
      runs-on:
        type: string
        default: "ubuntu-latest"
      upload-sarif:
        type: boolean
        default: true
      working-directory:
        type: string
        default: "."

jobs:
  infra-security-scan:
    name: Scan with Kics
    runs-on: ${{ inputs.runs-on }}
    permissions:
      contents: read
      pull-requests: write
      security-events: write
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481
        # v2.11.0
        with:
          disable-sudo: ${{ inputs.disable-sudo }}
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            kics.io:443
            packages.wolfi.dev:443
            registry.npmjs.org:443
            ${{ inputs.egress-policy-allowlist }}
      - name: Checkout Source
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        # v4.2.2
        with:
          persist-credentials: false
      - name: Kics Scan
        uses: Checkmarx/kics-github-action@3246fb456a46d1ea8848ae18793c036718b19fe0
        # v2.1.5
        with:
          path: .
          output_path: ${{ inputs.working-directory }}/kics_results.sarif
          output_formats: sarif
          fail_on: high,medium
          token: ${{ github.token }}
          enable_comments: ${{ inputs.enable-comments }}
          enable_annotations: true
          enable_jobs_summary: true
          comments_with_queries: true
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@3407610120cd5656b6fc71991415cb50748b9489
        # v2.20.1
        with:
          sarif_file: ${{ inputs.working-directory }}/kics_results.sarif

  zizmor:
    name: zizmor GitHub Actions Security Analysis
    runs-on: ${{ inputs.runs-on }}
    permissions:
      contents: read
      pull-requests: write
      security-events: write
    steps:
      - uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481
        # v2.11.0
        with:
          disable-sudo: ${{ inputs.disable-sudo }}
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            files.pythonhosted.org:443
            github.com:443
            objects.githubusercontent.com:443
            pypi.org:443
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        # v4.2.2
        with:
          persist-credentials: false
      - name: Install the latest version of uv
        uses: astral-sh/setup-uv@1edb52594c857e2b5b13128931090f0640537287
        # v5.3.0
      - name: Run zizmor 🌈
        run: uvx zizmor --format sarif . > zizmor_results.sarif
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@3407610120cd5656b6fc71991415cb50748b9489
        # v2.20.1
        with:
          sarif_file: zizmor_results.sarif
          category: zizmor

  checkmake:
    name: Check Makefile
    runs-on: ${{ inputs.runs-on }}
    permissions:
      contents: read
      pull-requests: write
      security-events: write
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481
        # v2.11.0
        with:
          disable-sudo: ${{ inputs.disable-sudo }}
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            storage.googleapis.com:443
            sum.golang.org:443
            ${{ inputs.egress-policy-allowlist }}
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        # v4.2.2
        with:
          persist-credentials: false
      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34
        # v5.3.0
        with:
          go-version: "oldstable"
          cache: false
      - id: find-files
        run: |
          FILES=$(find . -iname "Makefile" -o -iname "GNUmakefile" -o -iname "*.mk" -o -iname "*.make")
          echo "$FILES" > "$GITHUB_WORKSPACE/files.txt"
          echo "FILES=$FILES" >> $GITHUB_OUTPUT
        shell: bash
      - if: steps.find-files.outputs.FILES != ''
        id: scan-files
        continue-on-error: true
        run: |
          go install github.com/mrtazz/checkmake/cmd/checkmake@latest
          CHECKMAKE_OUTPUT=$(checkmake "$FILES" --debug)
          echo "CHECKMAKE_OUTPUT=$CHECKMAKE_OUTPUT" >> $GITHUB_OUTPUT
        env:
          FILES: ${{ steps.find-files.outputs.FILES }}
        shell: bash
      - name: PR comment with file
        if: github.event_name == 'pull_request' && steps.scan-files.outputs.CHECKMAKE_OUTPUT != ''
        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
        # v3.0.1
        with:
          message: |
            <details>
            <summary>Checkmake findings</summary>

            ```
            ${{ steps.scan-files.outputs.CHECKMAKE_OUTPUT }}
            ```

            </details>