Skip to content

Commit ac383c9

Browse files
LCSOGthbLCSOGthb
authored
Merge branch 'main' into LCSOGthb-patch-1
2 parents 8b472af + 8d0c6c5 commit ac383c9

4 files changed

Lines changed: 233 additions & 0 deletions

File tree

‎.github/workflows/black-duck-security-scan-ci.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# Black Duck Security Action allows you to integrate Static Analysis Security Testing (SAST) and Software Composition Analysis (SCA) into your CI/CD pipelines.
7+
# For more information about configuring your workflow,
8+
# read our documentation at https://github.com/blackduck-inc/black-duck-security-scan
9+
10+
name: CI Black Duck security scan
11+
12+
on:
13+
push:
14+
branches: [ "main" ]
15+
pull_request:
16+
# The branches below must be a subset of the branches above
17+
branches: [ "main" ]
18+
schedule:
19+
- cron: '34 15 * * 5'
20+
21+
jobs:
22+
build:
23+
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
pull-requests: write
27+
security-events: write
28+
actions: read
29+
30+
steps:
31+
- name: Checkout source
32+
uses: actions/checkout@v4
33+
- name: Black Duck SCA scan
34+
uses: blackduck-inc/black-duck-security-scan@805cbd09e806b01907bbea0f990723c2bb85abe9
35+
with:
36+
### ---------- BLACKDUCK SCA SCANNING: REQUIRED FIELDS ----------
37+
blackducksca_url: ${{ vars.BLACKDUCKSCA_URL }}
38+
blackducksca_token: ${{ secrets.BLACKDUCKSCA_TOKEN }}
39+
40+
### ---------- COVERITY SCANNING: REQUIRED FIELDS ----------
41+
coverity_url: ${{ vars.COVERITY_URL }}
42+
coverity_user: ${{ secrets.COVERITY_USER }}
43+
coverity_passphrase: ${{ secrets.COVERITY_PASSPHRASE }}
44+
45+
### ---------- POLARIS SCANNING: REQUIRED FIELDS ----------
46+
polaris_server_url: ${{ vars.POLARIS_SERVER_URL }}
47+
polaris_access_token: ${{ secrets.POLARIS_ACCESS_TOKEN }}
48+
polaris_assessment_types: "SCA,SAST"
49+
50+
### ---------- SRM SCANNING: REQUIRED FIELDS ----------
51+
srm_url: ${{ vars.SRM_URL }}
52+
srm_apikey: ${{ secrets.SRM_API_KEY }}
53+
srm_assessment_types: "SCA,SAST"
54+

‎.github/workflows/eslint.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
# ESLint is a tool for identifying and reporting on patterns
6+
# found in ECMAScript/JavaScript code.
7+
# More details at https://github.com/eslint/eslint
8+
# and https://eslint.org
9+
10+
name: ESLint
11+
12+
on:
13+
push:
14+
branches: [ "main" ]
15+
pull_request:
16+
# The branches below must be a subset of the branches above
17+
branches: [ "main" ]
18+
schedule:
19+
- cron: '38 16 * * 6'
20+
21+
jobs:
22+
eslint:
23+
name: Run eslint scanning
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
security-events: write
28+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@v4
32+
33+
- name: Install ESLint
34+
run: |
35+
npm install eslint@8.10.0
36+
npm install @microsoft/eslint-formatter-sarif@3.1.0
37+
38+
- name: Run ESLint
39+
env:
40+
SARIF_ESLINT_IGNORE_SUPPRESSED: "true"
41+
run: npx eslint .
42+
--config .eslintrc.js
43+
--ext .js,.jsx,.ts,.tsx
44+
--format @microsoft/eslint-formatter-sarif
45+
--output-file eslint-results.sarif
46+
continue-on-error: true
47+
48+
- name: Upload analysis results to GitHub
49+
uses: github/codeql-action/upload-sarif@v3
50+
with:
51+
sarif_file: eslint-results.sarif
52+
wait-for-processing: true

‎.github/workflows/osv-scanner.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
7+
# in addition to a PR check which fails if new vulnerabilities are introduced.
8+
#
9+
# For more examples and options, including how to ignore specific vulnerabilities,
10+
# see https://google.github.io/osv-scanner/github-action/
11+
12+
name: OSV-Scanner
13+
14+
on:
15+
pull_request:
16+
branches: [ "main" ]
17+
merge_group:
18+
branches: [ "main" ]
19+
schedule:
20+
- cron: '41 4 * * 1'
21+
push:
22+
branches: [ "main" ]
23+
24+
permissions:
25+
# Require writing security events to upload SARIF file to security tab
26+
security-events: write
27+
# Read commit contents
28+
contents: read
29+
30+
jobs:
31+
scan-scheduled:
32+
if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
33+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@1f1242919d8a60496dd1874b24b62b2370ed4c78" # v1.7.1
34+
with:
35+
# Example of specifying custom arguments
36+
scan-args: |-
37+
-r
38+
--skip-git
39+
./
40+
scan-pr:
41+
if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
42+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@1f1242919d8a60496dd1874b24b62b2370ed4c78" # v1.7.1
43+
with:
44+
# Example of specifying custom arguments
45+
scan-args: |-
46+
-r
47+
--skip-git
48+
./

‎.github/workflows/snyk-security.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# A sample workflow which sets up Snyk to analyze the full Snyk platform (Snyk Open Source, Snyk Code,
7+
# Snyk Container and Snyk Infrastructure as Code)
8+
# The setup installs the Snyk CLI - for more details on the possible commands
9+
# check https://docs.snyk.io/snyk-cli/cli-reference
10+
# The results of Snyk Code are then uploaded to GitHub Security Code Scanning
11+
#
12+
# In order to use the Snyk Action you will need to have a Snyk API token.
13+
# More details in https://github.com/snyk/actions#getting-your-snyk-token
14+
# or you can signup for free at https://snyk.io/login
15+
#
16+
# For more examples, including how to limit scans to only high-severity issues
17+
# and fail PR checks, see https://github.com/snyk/actions/
18+
19+
name: Snyk Security
20+
21+
on:
22+
push:
23+
branches: ["main" ]
24+
pull_request:
25+
branches: ["main"]
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
snyk:
32+
permissions:
33+
contents: read # for actions/checkout to fetch code
34+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
35+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@v4
39+
- name: Set up Snyk CLI to check for security issues
40+
# Snyk can be used to break the build when it detects security issues.
41+
# In this case we want to upload the SAST issues to GitHub Code Scanning
42+
uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
43+
44+
# For Snyk Open Source you must first set up the development environment for your application's dependencies
45+
# For example for Node
46+
#- uses: actions/setup-node@v4
47+
# with:
48+
# node-version: 20
49+
50+
env:
51+
# This is where you will need to introduce the Snyk API token created with your Snyk account
52+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
53+
54+
# Runs Snyk Code (SAST) analysis and uploads result into GitHub.
55+
# Use || true to not fail the pipeline
56+
- name: Snyk Code test
57+
run: snyk code test --sarif > snyk-code.sarif # || true
58+
59+
# Runs Snyk Open Source (SCA) analysis and uploads result to Snyk.
60+
- name: Snyk Open Source monitor
61+
run: snyk monitor --all-projects
62+
63+
# Runs Snyk Infrastructure as Code (IaC) analysis and uploads result to Snyk.
64+
# Use || true to not fail the pipeline.
65+
- name: Snyk IaC test and report
66+
run: snyk iac test --report # || true
67+
68+
# Build the docker image for testing
69+
- name: Build a Docker image
70+
run: docker build -t your/image-to-test .
71+
# Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
72+
- name: Snyk Container monitor
73+
run: snyk container monitor your/image-to-test --file=Dockerfile
74+
75+
# Push the Snyk Code results into GitHub Code Scanning tab
76+
- name: Upload result to GitHub Code Scanning
77+
uses: github/codeql-action/upload-sarif@v3
78+
with:
79+
sarif_file: snyk-code.sarif

0 commit comments

Comments
 (0)