TCASVS/.github/workflows/main.yml at main · OWASP/TCASVS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: Build and Release TCASVS

on:
  push:
    branches:
      - main
    paths:
      - '5.0/**'
      - 'docker/**'
      - 'Makefile'
      - '.github/workflows/main.yml'
  pull_request:
    paths:
      - '5.0/**'
      - 'docker/**'
      - 'Makefile'
      - '.github/workflows/main.yml'

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v7

    - name: Log in to GitHub Container Registry
      uses: docker/login-action@v4
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build (or pull) the document builder image
      run: docker pull ghcr.io/owasp/tcasvs/documentbuilder:latest || docker build --pull --tag ghcr.io/owasp/tcasvs/documentbuilder:latest ./docker

    - name: Verify requirements parse correctly
      run: make verify

    - name: Build all exports
      run: make 5.0 FORMATS=all

    - name: Upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: tcasvs-5.0.0-outputs
        path: 5.0/dist/

    - name: Fetch the latest release tag
      id: fetch_latest_release
      if: github.event_name == 'push'
      run: |
        LATEST_TAG=$(curl -s https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r .tag_name)
        if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" == "null" ]; then
          LATEST_TAG=""
        fi
        echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV

    - name: Increment version
      id: increment_version
      if: github.event_name == 'push'
      run: |
        LATEST_TAG=${{ env.LATEST_TAG }}

        # TCASVS release line is anchored to ASVS-style v5.x tags.
        # Ignore legacy TASVS tags (for example v1.8.x) when deriving the next tag.
        if [[ "$LATEST_TAG" =~ ^v5\.([0-9]+)\.([0-9]+)$ ]]; then
          major=5
          minor=${BASH_REMATCH[1]}
          patch=${BASH_REMATCH[2]}
          NEW_VERSION="$major.$minor.$((patch + 1))"
          NEW_TAG="v$NEW_VERSION"
        else
          NEW_TAG="v5.0.0"
        fi

        echo "NEW_TAG=$NEW_TAG" >> $GITHUB_ENV

    - name: Create GitHub Release
      id: create_release
      if: github.event_name == 'push'
      uses: actions/create-release@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        tag_name: ${{ env.NEW_TAG }}
        release_name: TCASVS ${{ env.NEW_TAG }}
        draft: false
        prerelease: false

    - name: Upload PDF
      if: github.event_name == 'push'
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./5.0/dist/OWASP_Thick_Client_Application_Security_Verification_Standard_5.0.0_en.pdf
        asset_name: TCASVS-${{ env.NEW_TAG }}.pdf
        asset_content_type: application/pdf

    - name: Upload DOCX
      if: github.event_name == 'push'
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./5.0/dist/OWASP_Thick_Client_Application_Security_Verification_Standard_5.0.0_en.docx
        asset_name: TCASVS-${{ env.NEW_TAG }}.docx
        asset_content_type: application/vnd.openxmlformats-officedocument.wordprocessingml.document

    - name: Upload JSON
      if: github.event_name == 'push'
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./5.0/dist/OWASP_Thick_Client_Application_Security_Verification_Standard_5.0.0_en.json
        asset_name: TCASVS-${{ env.NEW_TAG }}.json
        asset_content_type: application/json

    - name: Upload CSV
      if: github.event_name == 'push'
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./5.0/dist/OWASP_Thick_Client_Application_Security_Verification_Standard_5.0.0_en.csv
        asset_name: TCASVS-${{ env.NEW_TAG }}.csv
        asset_content_type: text/csv

    - name: Upload CycloneDX
      if: github.event_name == 'push'
      uses: actions/upload-release-asset@v1
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        upload_url: ${{ steps.create_release.outputs.upload_url }}
        asset_path: ./5.0/dist/OWASP_Thick_Client_Application_Security_Verification_Standard_5.0.0_en.cdx.json
        asset_name: TCASVS-${{ env.NEW_TAG }}.cdx.json
        asset_content_type: application/json