Repository navigation

glsec

Demo: glsec findings as code scanning annotations #5

	name: glsec

	# Scans bad-pipeline.yml with glsec and uploads the SARIF report to GitHub
	# code scanning, which shows the findings as alerts and as annotations on the
	# lines a pull request changes.

	on:
	push:
	branches: [main]
	pull_request:
	workflow_dispatch:

	permissions: {}

	env:
	GLSEC_VERSION: "1.24.1"

	jobs:
	scan:
	name: Scan
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write # upload the SARIF report
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# The archive is checked against checksums.txt and against the
	# provenance of glsec's release workflow before it runs.
	- name: Install glsec
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	set -euo pipefail
	archive="glsec_${GLSEC_VERSION}_linux_amd64.tar.gz"
	base="https://github.com/glsec/glsec/releases/download/v${GLSEC_VERSION}"
	curl -sSfLO "$base/$archive"
	curl -sSfLO "$base/checksums.txt"
	grep " $archive\$" checksums.txt \| sha256sum -c -
	gh attestation verify "$archive" --repo glsec/glsec \
	--signer-workflow glsec/glsec/.github/workflows/build-release.yml
	tar xzf "$archive" glsec

	# glsec exits 1 when it finds something; only 2 (a parse error) fails
	# the job, so the report is uploaded either way.
	- name: Scan
	run: \|
	rc=0
	./glsec --format sarif bad-pipeline.yml > glsec.sarif \|\| rc=$?
	[ "$rc" -le 1 ]

	- uses: github/codeql-action/upload-sarif@e58424170fb0262c8d7ed60a2e84b9bffe205c67 # codeql-bundle-v2.26.1
	with:
	sarif_file: glsec.sarif
	category: glsec