Repository navigation
124 lines (111 loc) · 3.69 KB
/
Copy pathopencode-security.yml
File metadata and controls
124 lines (111 loc) · 3.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
name: OpenCode Security / Scan
on:
workflow_call:
inputs:
source_ref:
description: OpenCode Security ref to run.
required: false
type: string
default: main
runner:
description: Runner for the scan.
required: false
type: string
default: ubuntu-latest
model:
description: OpenCode model reference.
required: false
type: string
default: opencode-go/deepseek-v4-flash
mode:
description: Scan depth.
required: false
type: string
default: standard
fail_on_severity:
description: Highest finding severity that fails the job, or none.
required: false
type: string
default: high
max_cost_usd:
description: Maximum allowed spend for one scan.
required: false
type: number
default: 1
secrets:
OPENCODE_API_KEY:
description: OpenCode API key used only for this opt-in scan.
required: true
concurrency:
group: opencode-security-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
scan:
name: Scan
runs-on: ${{ inputs.runner }}
timeout-minutes: 30
env:
OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
OPENCODE_DISABLE_CLAUDE_CODE: "1"
OPENCODE_SECURITY_SOURCE: ${{ inputs.source_ref }}
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Checkout scanner
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: 0xPlayerOne/opencode-security
ref: ${{ inputs.source_ref }}
path: .opencode-security
persist-credentials: false
- name: Isolate scanner
shell: bash
run: mv .opencode-security "$RUNNER_TEMP/opencode-security"
- name: Set up Node.js
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
with:
node-version: "22"
package-manager-cache: false
- name: Set up Bun
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
with:
bun-version: "1.4.4"
- name: Install scanner
run: cd "$RUNNER_TEMP/opencode-security/sdk/typescript" && bun install --frozen-lockfile --ignore-scripts
- name: Build scanner
run: cd "$RUNNER_TEMP/opencode-security/sdk/typescript" && bun run build
- name: Run scan
shell: bash
env:
MODEL: ${{ inputs.model }}
MODE: ${{ inputs.mode }}
MAX_COST_USD: ${{ inputs.max_cost_usd }}
FAIL_ON_SEVERITY: ${{ inputs.fail_on_severity }}
run: |
set -euo pipefail
output_dir="$RUNNER_TEMP/opencode-security-results"
mkdir -p "$output_dir"
chmod 700 "$output_dir"
args=(
"$GITHUB_WORKSPACE"
--model "$MODEL"
--mode "$MODE"
--output-dir "$output_dir"
--max-cost "$MAX_COST_USD"
)
if [[ "$FAIL_ON_SEVERITY" != "none" ]]; then
args+=(--fail-on-severity "$FAIL_ON_SEVERITY")
fi
node "$RUNNER_TEMP/opencode-security/sdk/typescript/dist/cli.js" scan "${args[@]}"
- name: Upload scan results
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: opencode-security-results
path: ${{ runner.temp }}/opencode-security-results
if-no-files-found: ignore
retention-days: 14