77 lines
1.3 KiB
Bash
Executable File
77 lines
1.3 KiB
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
echo "============================"
|
|
echo " Davidson CI - Security"
|
|
echo "============================"
|
|
|
|
# -------------------------
|
|
# Composer audit
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Composer security audit"
|
|
|
|
if [ -f composer.lock ]; then
|
|
composer audit
|
|
else
|
|
echo "No composer.lock - skipping Composer audit"
|
|
fi
|
|
|
|
# -------------------------
|
|
# npm audit
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ npm security audit"
|
|
|
|
if [ -f package-lock.json ]; then
|
|
npm audit --audit-level=high
|
|
else
|
|
echo "No package-lock.json - skipping npm audit"
|
|
fi
|
|
|
|
# -------------------------
|
|
# Semgrep
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Semgrep"
|
|
|
|
semgrep scan \
|
|
--config=p/security-audit \
|
|
--error \
|
|
--exclude=node_modules \
|
|
--exclude=vendor \
|
|
.
|
|
|
|
# -------------------------
|
|
# Trivy vulnerability scan
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Trivy vulnerabilities"
|
|
|
|
trivy fs \
|
|
--scanners vuln \
|
|
--severity HIGH,CRITICAL \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
.
|
|
|
|
# -------------------------
|
|
# Trivy secret scan
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Trivy secrets"
|
|
|
|
trivy fs \
|
|
--scanners secret \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
.
|
|
|
|
echo
|
|
echo "Security module completed successfully"
|