diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml index 3d3ae35ac..bbfa42450 100644 --- a/.github/workflows/analysis.yml +++ b/.github/workflows/analysis.yml @@ -24,13 +24,33 @@ jobs: if: github.event_name != 'pull_request' || !github.event.pull_request.draft uses: ./.github/workflows/reusable-tests-fe.yml - repo-reports: - name: Repository Reports - uses: ./.github/workflows/reusable-tests-repo.yml + trivy: + name: Repository Report + if: github.event_name != 'pull_request' || !github.event.pull_request.draft + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v4 + - name: Run Trivy vulnerability scanner in repo mode + uses: aquasecurity/trivy-action@0.28.0 + with: + format: "sarif" + output: "trivy-results.sarif" + ignore-unfixed: true + scan-type: "fs" + scanners: "vuln,secret,config" + severity: "CRITICAL,HIGH" + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: "trivy-results.sarif" results: name: Analysis Results - needs: [tests-java, tests-frontend, repo-reports] + if: always() + needs: [tests-java, tests-frontend] # Restore trivy when/if fixed runs-on: ubuntu-24.04 steps: - - run: echo "Workflow completed successfully!" + - if: contains(needs.*.result, 'failure') + run: echo "At least one job has failed." && exit 1 + - run: echo "Success!" diff --git a/.github/workflows/reusable-tests-repo.yml b/.github/workflows/reusable-tests-repo.yml deleted file mode 100644 index f8949abb9..000000000 --- a/.github/workflows/reusable-tests-repo.yml +++ /dev/null @@ -1,63 +0,0 @@ -name: Reusable Unit Tests and Analysis - -on: - workflow_call: - -jobs: - trivy: - name: Repository Report - if: github.event_name != 'pull_request' || !github.event.pull_request.draft - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@v4 - - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@0.28.0 - with: - format: "sarif" - output: "trivy-results.sarif" - ignore-unfixed: true - scan-type: "fs" - scanners: "vuln,secret,config" - severity: "CRITICAL,HIGH" - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: "trivy-results.sarif" - - codeql: - name: Semantic Code Analysis - runs-on: ubuntu-24.04 - permissions: - actions: read - contents: read - security-events: write - steps: - - uses: actions/checkout@v4 - - uses: github/codeql-action/init@v3 - with: - languages: javascript,java - - # Autobuild failed for Java, so building manually - - name: Set up JDK 17 and Caching maven dependencies - uses: actions/setup-java@v4 - with: - distribution: "temurin" - java-version: "17" - cache: "maven" - - # Java builds - - name: Build Backend - working-directory: backend - run: ./mvnw clean package -DskipTests -Dtests.skip=true -Dskip.unit.tests=true - - - name: Build Legacy - working-directory: legacy - run: ./mvnw clean package -DskipTests -Dtests.skip=true -Dskip.unit.tests=true - - - name: Build Processor - working-directory: processor - run: ./mvnw clean package -DskipTests -Dtests.skip=true -Dskip.unit.tests=true - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3