security.yml

# Security scans before merging to main: run on PR/push to develop and main.
# Fix or acknowledge any reported vulnerabilities before merging develop → main.

name: Security

permissions:
  contents: read

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]

jobs:
  govulncheck:
    name: Go vulnerabilities
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck ./...

  grype:
    name: Grype (container image)
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build timestamp
        id: ts
        run: echo "b=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"

      - name: Build image
        uses: docker/build-push-action@v6
        with:
          context: .
          load: true
          push: false
          tags: gghstats:scan
          file: ./Dockerfile
          build-args: |
            VERSION=ci
            COMMIT=${{ github.sha }}
            BUILDDATE=${{ steps.ts.outputs.b }}

      # Same as `make docker-scan` fallback: official image + --pull=always (no stale :latest cache).
      - name: Run Grype on image
        run: |
          docker run --rm --pull=always \
            -v /var/run/docker.sock:/var/run/docker.sock \
            anchore/grype:latest \
            gghstats:scan --fail-on high