Place each security control in the pipeline and decide what it blocks

[[IgnoredVulns]]
id = "GO-2022-1059"
ignoreUntil = 2026-11-30
reason = "Accept-Language is capped at 256 bytes by the edge proxy; upgrade tracked in SEC-123"

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
    hooks:
      - id: gitleaks

rules:
  - id: go-http-server-without-timeouts
    languages: [go]
    severity: ERROR
    message: >-
      HTTP server without a header read timeout lets slow clients hold
      connections open. Use http.Server with ReadHeaderTimeout set.
    metadata:
      cwe: "CWE-400: Uncontrolled Resource Consumption"
    pattern-either:
      - pattern: http.ListenAndServe(...)
      - pattern: http.ListenAndServeTLS(...)
      - patterns:
          - pattern: "http.Server{...}"
          - pattern-not: "http.Server{..., ReadHeaderTimeout: $T, ...}"
          - pattern-not: "http.Server{..., ReadTimeout: $T, ...}"

# .github/workflows/devsecops.yml
# Pinned versions current on 2026-10-10. Let Dependabot or Renovate propose updates.
name: devsecops

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: "17 3 * * *" # nightly: full-history secrets scan, longer fuzzing

permissions:
  contents: read # every job starts read-only; jobs add only what they need

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  secrets:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: gitleaks (PR commits on pull requests, full history otherwise)
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          docker run --rm -v "$PWD:/repo" \
            ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
            git /repo --redact --no-banner ${BASE_SHA:+"--log-opts=$BASE_SHA..$HEAD_SHA"}

  semgrep:
    runs-on: ubuntu-24.04
    container: semgrep/semgrep:1.180.0@sha256:529ee8a277ec8adc5b534d7c74eea0a47e9de21d62852b6ba7ac6ba9566845c3
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Semgrep (blocks on new ERROR findings)
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          semgrep scan --config p/default --config semgrep-rules/ --exclude semgrep-rules \
            --severity ERROR --error --metrics off --sarif-output semgrep.sarif \
            ${BASE_SHA:+"--baseline-commit=$BASE_SHA"}
      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        if: ${{ !cancelled() }}
        with:
          sarif_file: semgrep.sarif
          category: semgrep

  codeql:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
      actions: read # needed in private repositories
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          languages: go
          build-mode: autobuild
          queries: security-extended
      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        with:
          category: /language:go

  osv-pr: # blocks only on vulnerabilities this pull request introduces
    if: github.event_name == 'pull_request'
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0

  osv-full: # catches new advisories against unchanged dependencies
    if: github.event_name != 'pull_request'
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0

  iac:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Checkov (blocks on a short list of checks, reports the rest)
        run: |
          docker run --rm -v "$PWD:/src" -w /src \
            ghcr.io/bridgecrewio/checkov:3.3.26@sha256:8e63f217cb084f1c1a067326a9cf6e37d54bdc82e5822210d50ca4e2f647dd93 \
            -d infra --framework terraform --compact --quiet \
            --hard-fail-on CKV_AWS_20,CKV_AWS_57,CKV_AWS_24,CKV_AWS_25,CKV_AWS_62 \
            -o cli -o sarif --output-file-path console,checkov.sarif
      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
        if: ${{ !cancelled() }}
        with:
          sarif_file: checkov.sarif
          category: checkov

  fuzz:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Fuzz the amount parser (60 s on pull requests, 15 min nightly)
        env:
          FUZZTIME: ${{ github.event_name == 'schedule' && '15m' || '60s' }}
        run: go test ./internal/money -run '^$' -fuzz '^FuzzParseCents$' -fuzztime "$FUZZTIME"
      - name: Keep failing inputs so they can be committed as regression tests
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: fuzz-failures
          path: internal/money/testdata/fuzz

  image:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - run: docker build -t expenses:ci .
      - name: Trivy (blocks on HIGH and CRITICAL findings that have a fix)
        run: |
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/src" -w /src \
            ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa \
            image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 expenses:ci
      - name: Start the app for DAST
        run: |
          docker run -d --name app -p 8080:8080 expenses:ci
          for _ in $(seq 30); do curl -fsS http://localhost:8080/healthz && break; sleep 1; done
      - name: ZAP baseline (blocks only on rules marked FAIL in .zap/rules.tsv)
        uses: zaproxy/action-baseline@de8ad967d3548d44ef623df22cf95c3b0baf8b25 # v0.15.0
        with:
          target: http://localhost:8080/amount?v=12.34
          docker_name: ghcr.io/zaproxy/zaproxy:2.17.0@sha256:7aaa659b0d43078febd82e29bad112285c370727e86ab8340444220e17d9f0d2
          rules_file_name: .zap/rules.tsv
          cmd_options: -I
          fail_action: true
          allow_issue_writing: false

  release:
    if: github.event_name == 'push'
    needs: [secrets, semgrep, codeql, osv-full, iac, fuzz, image]
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
      artifact-metadata: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build, scan the exact image, push it, record its digest
        id: image
        run: |
          image="ghcr.io/${GITHUB_REPOSITORY,,}"
          docker build -t "$image:$GITHUB_SHA" .
          trivy() {
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$PWD:/src" -w /src \
              ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa "$@"
          }
          trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 "$image:$GITHUB_SHA"
          trivy image --format cyclonedx --output sbom.cdx.json "$image:$GITHUB_SHA"
          docker push "$image:$GITHUB_SHA"
          echo "name=$image" >> "$GITHUB_OUTPUT"
          echo "digest=$(docker buildx imagetools inspect "$image:$GITHUB_SHA" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT"
      - name: Attest SLSA build provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.image.outputs.digest }}
          push-to-registry: true
      - name: Attest the SBOM
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ${{ steps.image.outputs.name }}
          subject-digest: ${{ steps.image.outputs.digest }}
          sbom-path: sbom.cdx.json
          push-to-registry: true

# ZAP baseline rules: FAIL blocks the build, WARN reports, IGNORE suppresses (tab-separated)
10021	FAIL	(X-Content-Type-Options Header Missing)
10038	FAIL	(Content Security Policy (CSP) Header Not Set)
10049	IGNORE	(Storable and Cacheable Content: API responses carry no user data)

package money

import (
	"fmt"
	"testing"
)

func FuzzParseCents(f *testing.F) {
	for _, seed := range []string{"0", "12", "12.3", "12.34", "999999.99"} {
		f.Add(seed)
	}
	f.Fuzz(func(t *testing.T, s string) {
		cents, err := ParseCents(s) // must never panic
		if err != nil {
			return
		}
		if cents < 0 {
			t.Fatalf("ParseCents(%q) = %d, want >= 0", s, cents)
		}
		again, err := ParseCents(fmt.Sprintf("%d.%02d", cents/100, cents%100))
		if err != nil || again != cents {
			t.Fatalf("round trip of %q: got %d, %v", s, again, err)
		}
	})
}

# Kyverno 1.19: admit images only with SLSA provenance from the main-branch release workflow
apiVersion: policies.kyverno.io/v1
kind: ImageValidatingPolicy
metadata:
  name: require-release-provenance
spec:
  validationActions: [Deny]
  failurePolicy: Fail
  webhookConfiguration:
    timeoutSeconds: 30
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  matchImageReferences:
    - glob: "ghcr.io/example-org/expenses*"
  attestors:
    - name: release
      cosign:
        keyless:
          identities:
            - issuer: https://token.actions.githubusercontent.com
              subject: https://github.com/example-org/expenses/.github/workflows/devsecops.yml@refs/heads/main
        ctlog:
          url: https://rekor.sigstore.dev
  attestations:
    - name: slsa
      intoto:
        type: https://slsa.dev/provenance/v1
  validations:
    - expression: >-
        images.containers.map(image, verifyAttestationSignatures(image, attestations.slsa, [attestors.release])).all(e, e > 0)
      message: Image lacks SLSA provenance from the main-branch release workflow

cosign verify ghcr.io/aquasecurity/trivy:0.75.0 \
  --certificate-identity-regexp '^https://github.com/aquasecurity/trivy/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com