add specialized workflows

Author: maxammann

.github/workflows/security-default-branch.yml

@@ -0,0 +1,30 @@
+on:
+  push:
+    branches:
+      - main
+
+name: Security
+
+jobs:
+  sbom-trivy:
+    runs-on: ubuntu-latest
+
+    container:
+      image: aquasec/trivy:0.67.2
+
+    steps:
+      - run: trivy --version
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - run: trivy fs --format cyclonedx --output /tmp/trivy-cyclonedx.json .
+      - run: apk --no-cache add curl
+      - run: |
+          curl -X "POST" "https://dependency-track-sbom.corp.zoo.dev/api/v1/bom" \
+               -H 'Content-Type: multipart/form-data' \
+                -H "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_AUTOMATION_API_KEY }}" \
+               -F "autoCreate=true" \
+               -F "projectName=${{ github.repository }}" \
+               -F "projectVersion=main" \
+               -F "isLatest=$IS_LATEST" \
+               -F "bom=@/tmp/trivy-cyclonedx.json"

.github/workflows/semgrep.yml renamed to .github/workflows/security-pr.yml

@@ -1,7 +1,7 @@
 on:
   pull_request:
 
-name: Semgrep scan
+name: Security
 
 jobs:
   semgrep:
@@ -18,20 +18,19 @@ jobs:
       image: semgrep/semgrep
 
     steps:
-      - run: /usr/bin/jq --version
       - uses: actions/checkout@v3
         with:
           fetch-depth: 0
       - run: |
-         git clone https://github.com/trailofbits/semgrep-rules $HOME/semgrep-rules-tob
-         git clone https://github.com/semgrep/semgrep-rules $HOME/semgrep-rules
-         git -C $HOME/semgrep-rules reset --hard 518f71b883d431fa33268844b066033507e7c1b5
-         git -C $HOME/semgrep-rules-tob reset --hard 3b91c9b622b4a250b144a832ce73091b1f25e207
-         rm $HOME/semgrep-rules-tob/.github/workflows/update-semgrep-registry.yml
-         rm $HOME/semgrep-rules/.pre-commit-config.yaml
-         rm -rf $HOME/semgrep-rules-tob/.github
-         rm -rf $HOME/semgrep-rules/.github
-         rm -rf $HOME/semgrep-rules/stats
+          git clone https://github.com/trailofbits/semgrep-rules $HOME/semgrep-rules-tob
+          git clone https://github.com/semgrep/semgrep-rules $HOME/semgrep-rules
+          git -C $HOME/semgrep-rules reset --hard 518f71b883d431fa33268844b066033507e7c1b5
+          git -C $HOME/semgrep-rules-tob reset --hard 3b91c9b622b4a250b144a832ce73091b1f25e207
+          rm $HOME/semgrep-rules-tob/.github/workflows/update-semgrep-registry.yml
+          rm $HOME/semgrep-rules/.pre-commit-config.yaml
+          rm -rf $HOME/semgrep-rules-tob/.github
+          rm -rf $HOME/semgrep-rules/.github
+          rm -rf $HOME/semgrep-rules/stats
       - run: git config --global --add safe.directory $(pwd)
       - run: |
           semgrep scan --config $HOME/semgrep-rules --config $HOME/semgrep-rules-tob \
@@ -43,6 +42,7 @@ jobs:
             --exclude="*.html" --exclude="*.js" \
             --baseline-commit=${{ github.event.pull_request.base.sha }} \
             --json > /tmp/semgrep-results.json || true
+      - run: /usr/bin/jq --version
       - name: Notice
         shell: bash
         run: |
@@ -65,4 +65,3 @@ jobs:
   #        sarif_file: /tmp/semgrep-results.sarif
   #      if: always()
 
-

.gitignore

@@ -0,0 +1 @@
+.idea