security_scan.yml

name: "Test and Coverage"

on: 
  push:
    branches:
      - '*'
      - '**'
      - '*/*'
      - '**/**'
      - '!dev'
    tags-ignore:
      - '**'
  workflow_call:



jobs:
  semgrep_scan:
    name: Smegrep Scan Analysis
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: 3.x
    
    - name: Install semgrep
      run: python3 -m pip install semgrep
    
    - name: Run semgrep
      run:  semgrep scan --error
  trivy_scan:
    name: Trivy Scan Analysis
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    - name: Install Trivy
      run: |
        sudo apt-get install wget apt-transport-https gnupg lsb-release
        wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
        echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
        sudo apt-get update
        sudo apt-get install trivy

    - name: Run Trivy on filesystem
      run: trivy fs --scanners vuln,misconfig,secret,license --severity HIGH,CRITICAL --exit-code 1 .