Skip to content

Add Scandog combined scanner #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
scandog-io wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add Scandog combined scanner #5

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5837ce0
Add .github/workflows/scandog-combined-scanner.yml with Scandog secur…
scandog-io[bot] Sep 12, 2025
de41857
Add .github/workflows/scandog-combined-scanner.yml with Scandog secur…
scandog-io[bot] Sep 12, 2025
e7a4465
Add .github/workflows/scandog-combined-scanner.yml with Scandog secur…
scandog-io[bot] Sep 12, 2025
b16d3c5
Update scandog-combined-scanner.yml
omid Sep 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
286 changes: 286 additions & 0 deletions .github/workflows/scandog-combined-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,286 @@
# Combined configuration from 12 templates
# Scanners: Semgrep, OWASP Depscan + cdxgen, tfsec, grype, Gitleaks, CDXGen, Trivy, checkov, Trivy, osv-scanner, Trufflehog, opengrep
# Generated for GITHUB by ScanDog
name: Combined Security Scanner Pipeline
on:
pull_request:
branches:
- master
workflow_dispatch:

jobs:
# Jobs from template: Semgrep
scandog_semgrep_scan:
runs-on: ubuntu-latest
container:
image: semgrep/semgrep
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: semgrep scan
run: semgrep scan --config auto --json > semgrep.json
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: semgrep.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: SAST
scanner: Semgrep
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: OWASP Depscan + cdxgen
scandog_depscan_sca:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.x'
- name: Install OWASP-depscan
run: |
pip install owasp-depscan
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: 21
- name: Install cdxgen
run: npm install -g @cyclonedx/cdxgen
- name: scan SBOM by OWASP depscan
run: |
cd $GITHUB_WORKSPACE
export FETCH_LICENSE=true
depscan -i . --reports-dir .
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: sbom-universal.vdr.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: SCA
scanner: depscan
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: tfsec
scandog_tfsec_scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run tfsec
uses: aquasecurity/tfsec-action@v1.0.0
with:
format: json
out: tfsec-results.json
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: tfsec-results.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: IaC Scanner
scanner: tfsec
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: grype
scandog_grype_sca:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Grype
uses: anchore/scan-action@v6
with:
path: .
output-format: json
output-file: grype-results.json
fail-build: false
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: grype-results.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: SCA
scanner: grype
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: Gitleaks
scandog_gitleaks_scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install & Run Gitleaks
run: |
git clone https://github.com/gitleaks/gitleaks.git
cd gitleaks
make build
cd $GITHUB_WORKSPACE
gitleaks dir . -f json -r gitleaks.json
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: gitleaks.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: Secret Scanning
scanner: gitleaks
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: CDXGen
scandog_cdxgen_scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install cdxgen
run: npm install -g @cyclonedx/cdxgen
- name: Generate SBOM
run: cdxgen --input . --output sbom.json
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: sbom.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: SBOM
scanner: cdxgen
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: Trivy
scandog_trivy_scan_a:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: rabbitmq:management
format: 'json'
output: 'trivy-results.json'
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: trivy-results.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: Container Scanner
scanner: Trivy
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: checkov
scandog_checkov_scan:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Checkov GitHub Action
uses: bridgecrewio/checkov-action@v12
with:
soft_fail: true
output_format: json
output_file_path: .
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: results_json.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: IaC Scanner
scanner: checkov
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: Trivy
scandog_trivy_scan_b:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: .
format: 'json'
output: 'trivy-results.json'
scanners: 'misconfig'
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: trivy-results.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: IaC Scanner
scanner: Trivy
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: osv-scanner
scandog_osv_scanner_scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install osv-scanner
run: |
sudo apt-get update
sudo apt-get install -y snapd
sudo snap install osv-scanner
- name: Run osv-scanner
run: osv-scanner scan . --json osv-results.json
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: osv-results.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: SCA
scanner: osv-scanner
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: Trufflehog
scandog_trufflehog_scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install & Run Trufflehog
run: |
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
trufflehog filesystem --json . > trufflehog.json
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: trufflehog.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: Secret Scanning
scanner: trufflehog
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
# Jobs from template: opengrep
scandog_opengrep_scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Install Opengrep
run: |
apt-get update && apt-get install -y curl jq
latest_version=$(curl --silent "https://api.github.com/repos/opengrep/opengrep/releases/latest" | jq -r .tag_name)
curl -L -o opengrep "https://github.com/opengrep/opengrep/releases/download/${latest_version}/opengrep_manylinux_x86"
chmod +x opengrep
mv opengrep /usr/local/bin/opengrep
- name: Run Opengrep
run: opengrep scan --config auto --json-output=opengrep.json .
- name: Import results to ScanDog
uses: scandogio/scandog-import@v1.0
with:
ci_run_id: ${{ github.run_id }}
report_file: opengrep.json
workflow_id: "77870259287eac45b40e65decf2207c3"
scan_type: SAST
scanner: opengrep
backend_api_token: ${{ secrets.SCANDOG_BACKEND_API_TOKEN }}
backend_url: ${{ secrets.SCANDOG_BACKEND_URL }}
Loading