msdo-dynamic-scanning.yml

name: msdo-dynamic-scanning

on:
  workflow_dispatch:
  workflow_call:
    inputs:
      branch:
        required: false
        type: string
        default: 'main'
    secrets:
      GH_TOKEN:
        required: false

jobs:
  msdo:
    name: Microsoft Security DevOps
    runs-on: ubuntu-latest

    permissions:
      contents: read
      id-token: write
      actions: read
      security-events: write

    steps:
      - name: Manually checkout repository (internal-safe)
        run: |
          git clone https://github.com/${{ github.repository }} .
          git checkout ${{ inputs.branch }}

      - name: Set environment variables for tools
        shell: pwsh
        run: |
          $TOOLS = ""

          if ((Get-ChildItem -Recurse -Include *.js, *.jsx, *.ts, *.tsx  | Measure-Object).Count -gt 0) {
            $TOOLS += "eslint,"
            echo "ESLint enabled - JS/JSX/TS/TSX files detected."
          } else {
            echo "ESLint skipped - No JS/JSX/TS/TSX files found."
          }

          if ((Get-ChildItem -Recurse -Include *.exe, *.dll | Measure-Object).Count -gt 0) {
            $TOOLS += "binskim,"
            echo "BinSkim enabled - EXE/DLL files detected."
          } else {
            echo "BinSkim skipped - No EXE/DLL files found."
          }

          if ((Get-ChildItem -Recurse -Include *.py | Measure-Object).Count -gt 0) {
            $TOOLS += "bandit,"
            echo "Bandit enabled - Python files detected."
          } else {
            echo "Bandit skipped - No Python files found."
          }

          if ((Get-ChildItem -Recurse -Include *.tf, *.json, *.yml, *.yaml, *.dockerfile, *.template, *.bicep | Measure-Object).Count -gt 0) {
            $TOOLS += "checkov,"
            echo "Checkov enabled - Terraform/JSON/YML/YAML/Dockerfiles/Templates/Bicep files detected."
          } else {
            echo "Checkov skipped - No Terraform/JSON/YML/YAML/Dockerfiles/Templates/Bicep files found."
          }

          if ((Get-ChildItem -Recurse -Include *.json | Select-String 'resources' | Measure-Object).Count -gt 0) {
            $TOOLS += "templateanalyzer,"
            echo "Template Analyzer enabled - ARM templates detected."
          }

          if ((Get-ChildItem -Recurse -Include *.bicep | Measure-Object).Count -gt 0) {
            $TOOLS += "templateanalyzer,"
            echo "Template Analyzer enabled - Bicep files detected."
          }

          if ((Get-ChildItem -Recurse -Include *.tf, *.json, *.yml, *.yaml | Measure-Object).Count -gt 0) {
            $TOOLS += "terrascan,"
            echo "Terrascan enabled - Terraform/JSON/YML/YAML files detected."
          }

          if ((Get-ChildItem -Recurse -Include Dockerfile | Measure-Object).Count -gt 0) {
            $TOOLS += "trivy,"
            echo "Trivy enabled - Dockerfiles detected."
          }

          $TOOLS = $TOOLS.TrimEnd(',')

          if ($TOOLS -eq "") {
            echo "No applicable tools found. The MSDO scan will be skipped."
            exit 0
          }

          echo "TOOLS=$TOOLS" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8

      - name: Run Microsoft Security DevOps
        uses: theangrytech-git/security-devops-action@main
        id: msdo
        with:
          tools: ${{ env.TOOLS }}

      - name: Check Repository Visibility
        shell: bash
        run: |
          if [ "${{ github.repository_visibility }}" == "private" ]; then
            echo "This is a private repository. Code Scanning is not available unless GitHub Advanced Security (GHAS) is enabled."
            exit 0
          fi

      - name: Upload SARIF to GitHub Code Scanning
        if: github.repository_visibility == 'public'
        run: |
          echo "Compressing and uploading SARIF..."
          sarif_file="${{ steps.msdo.outputs.sarifFile }}"
          if [ ! -f "$sarif_file" ]; then
            echo "SARIF file not found at $sarif_file"
            exit 0
          fi

          gzip -c "$sarif_file" | base64 -w 0 > msdo.sarif.base64
          encoded_sarif=$(cat msdo.sarif.base64)

          curl -s -X POST \
            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
            -H "Accept: application/vnd.github+json" \
            -H "Content-Type: application/json" \
            https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs \
            -d @- <<EOF
            {
          "commit_sha": "${{ github.sha }}",
          "ref": "${{ github.ref }}",
          "sarif": "$encoded_sarif",
          "checkout_uri": "https://github.com/${{ github.repository }}",
          "tool_name": "MSDO"
          }
          EOF