tooltrust-scanner/.github/workflows/security.yml at b819a1c30cd26555174a83737c8ba08d3509cf13 · AgentSafe-AI/tooltrust-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
name: Security

on:
  push:
    branches: ["main", "master"]
  pull_request:
    branches: ["main", "master"]
  schedule:
    # Run every Monday at 08:00 UTC
    - cron: "0 8 * * 1"

permissions:
  contents: read
  security-events: write   # needed to upload SARIF results to GitHub Security tab

jobs:
  source:
    name: Prepare Source Tree
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Package source tree
        run: tar --exclude='.git' -czf /tmp/source-tree.tar.gz .

      - name: Upload source tree
        uses: actions/upload-artifact@v4
        with:
          name: source-tree
          path: /tmp/source-tree.tar.gz
          retention-days: 1

  # ── 1. Go vulnerability scan (govulncheck) ────────────────────────────────
  govulncheck:
    name: Go Vulnerability Check
    runs-on: ubuntu-latest
    needs: [source]

    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.5"
          cache: true

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: govulncheck ./...

  # ── 2. Static security analysis (gosec) ──────────────────────────────────
  gosec:
    name: GoSec Static Analysis
    runs-on: ubuntu-latest
    needs: [source]

    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.5"
          cache: true

      - name: Run gosec
        uses: securego/gosec@master
        continue-on-error: true   # findings upload to Security tab; don't block CI
        with:
          # G304 (file path from CLI flag) is intentional behaviour in a CLI tool.
          # Results are reviewed via the SARIF upload to the GitHub Security tab.
          args: >-
            -fmt sarif
            -out gosec-results.sarif
            -severity medium
            -exclude-dir dist
            ./...

      - name: Upload SARIF results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: gosec-results.sarif

  # ── 3. Dependency review on PRs ───────────────────────────────────────────
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    needs: [source]

    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"
      - uses: actions/dependency-review-action@v4
        continue-on-error: true  # requires Dependency Graph enabled in repo settings
        with:
          fail-on-severity: high

  # ── 4. ToolTrust Scanner scans its own MCP tool fixtures (meta-scan) ────────
  meta-scan:
    name: ToolTrust Meta-Scan
    runs-on: ubuntu-latest
    needs: [source]

    steps:
      - name: Download source tree
        uses: actions/download-artifact@v4
        with:
          name: source-tree
          path: /tmp/source

      - name: Extract source tree
        run: tar -xzf /tmp/source/source-tree.tar.gz -C "$GITHUB_WORKSPACE"

      - uses: actions/setup-go@v5
        with:
          go-version: "1.26.5"
          cache: true

      - name: Build tooltrust-scanner
        run: go build -o /tmp/tooltrust-scanner ./cmd/tooltrust-scanner/

      - name: Run meta-scan against project's MCP tool fixtures
        run: |
          if [ -f testdata/tools.json ]; then
            /tmp/tooltrust-scanner scan --protocol mcp --input testdata/tools.json --output json --file /tmp/meta_scan.json
          else
            echo '{"tools":[]}' > /tmp/empty.json
            /tmp/tooltrust-scanner scan --protocol mcp --input /tmp/empty.json --output json --file /tmp/meta_scan.json
          fi
          cat /tmp/meta_scan.json

      - name: Fail on BLOCKED tools
        run: |
          BLOCKED=$(jq '.summary.blocked // 0' /tmp/meta_scan.json)
          if [ "$BLOCKED" -gt "0" ]; then
            echo "Meta-scan detected $BLOCKED BLOCKED tool(s)."
            exit 1
          fi
          echo "Meta-scan passed — no blocked tools."

      - name: Upload meta-scan report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: meta-scan-report
          path: /tmp/meta_scan.json
          retention-days: 30