neonatal/.github/workflows/security.yml at main · Raster-Lab/neonatal · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
# Security Scanning — NICU Management System
#
# Runs CodeQL static analysis and OWASP Dependency Check on every push
# to main/develop, on pull requests, and on a weekly schedule.
#
# Implements security requirements from .github/copilot-instructions.md:
#   - OWASP Dependency Check for known vulnerabilities in dependencies
#   - CodeQL for static analysis of Java and TypeScript/JavaScript code
#
# Expected project layout:
#   backend/   — Java 21 + Spring Boot 3.x multi-module Gradle project
#   frontend/  — Angular 17+ workspace

name: Security

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    # Run weekly on Monday at 06:00 UTC
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ---------------------------------------------------------------------------
  # CodeQL — Static Analysis (Java + TypeScript)
  # ---------------------------------------------------------------------------
  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        language: [java-kotlin, javascript-typescript]
        include:
          - language: java-kotlin
            build-mode: autobuild
          - language: javascript-typescript
            build-mode: none

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        if: matrix.language == 'java-kotlin'
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: gradle
          cache-dependency-path: backend/build.gradle

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: '/language:${{ matrix.language }}'

  # ---------------------------------------------------------------------------
  # OWASP Dependency Check — Backend (Gradle)
  # ---------------------------------------------------------------------------
  owasp-backend:
    name: OWASP Dependency Check (Backend)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: backend

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
          cache: gradle
          cache-dependency-path: backend/build.gradle

      - name: Run OWASP Dependency Check
        run: ./gradlew dependencyCheckAnalyze

      - name: Upload OWASP report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: owasp-backend-report
          path: backend/**/build/reports/dependency-check-report.html
          retention-days: 14

  # ---------------------------------------------------------------------------
  # npm audit — Frontend
  # ---------------------------------------------------------------------------
  npm-audit:
    name: npm Audit (Frontend)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit
        run: npm audit --audit-level=high