Skip to content

Commit 370ba0a

Browse files
kailash-bkailash-b
authored
Integrate rl-scanner (#145)
2 parents 0032a7b + a6f59b3 commit 370ba0a

3 files changed

Lines changed: 163 additions & 1 deletion

File tree

‎.github/actions/rl-scanner/action.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: 'Reversing Labs Scanner'
2+
description: 'Runs the Reversing Labs scanner on a specified artifact.'
3+
inputs:
4+
artifact-path:
5+
description: 'Path to the artifact to be scanned.'
6+
required: true
7+
version:
8+
description: 'Version of the artifact.'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: '3.10'
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: 'The outcome of the scan process.'
71+
value: ${{ env.scan-status }}

‎.github/workflows/release.yml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,36 @@ on:
44
pull_request:
55
types:
66
- closed
7+
78
workflow_dispatch:
89

910
permissions:
1011
contents: write
12+
pull-requests: write
13+
id-token: write
1114

1215
### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows` and append `@latest` after the common `dx-sdk-actions` repo is made public.
1316
### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `nuget-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
1417
### TODO: Also remove `nuget-release` workflow from this repo's .github/workflows folder once the repo is public.
1518

1619
jobs:
20+
rl-scanner:
21+
uses: ./.github/workflows/rl-secure.yml
22+
with:
23+
project-path: "src/Auth0.AspNetCore.Authentication/Auth0.AspNetCore.Authentication.csproj"
24+
artifact-name: "auth0-aspnetcore-authentication.tgz"
25+
secrets:
26+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
27+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
28+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
29+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
30+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
31+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
32+
33+
1734
release:
18-
uses: ./.github/workflows/nuget-release.yml
35+
needs: rl-scanner
36+
uses: ./.github/workflows/nuget-release.yml
1937
with:
2038
dotnet-version: 6.0.x
2139
project-paths: "['src/Auth0.AspNetCore.Authentication/Auth0.AspNetCore.Authentication.csproj']"

‎.github/workflows/rl-secure.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: RL-Secure Workflow
2+
run-name: rl-scanner
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
project-path:
8+
type: string
9+
required: true
10+
artifact-name:
11+
type: string
12+
required: true
13+
secrets:
14+
RLSECURE_LICENSE:
15+
required: true
16+
RLSECURE_SITE_KEY:
17+
required: true
18+
SIGNAL_HANDLER_TOKEN:
19+
required: true
20+
PRODSEC_TOOLS_USER:
21+
required: true
22+
PRODSEC_TOOLS_TOKEN:
23+
required: true
24+
PRODSEC_TOOLS_ARN:
25+
required: true
26+
27+
jobs:
28+
rl-scanner:
29+
name: Run Reversing Labs scanner
30+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
31+
runs-on: ubuntu-latest
32+
outputs:
33+
scan-status: ${{ steps.rl-scan-conclusion.outcome }}
34+
35+
steps:
36+
- name: Checkout code
37+
uses: actions/checkout@v4
38+
with:
39+
fetch-depth: 0
40+
41+
- name: Setup .NET
42+
uses: actions/setup-dotnet@v3
43+
with:
44+
dotnet-version: 6.0.x
45+
46+
- name: Create NuGet packages
47+
shell: pwsh
48+
run: |
49+
dotnet pack ${{ inputs.project-path }} --configuration Release --output ${{ github.workspace }}/nuget
50+
51+
- name: Create tgz build artifact
52+
run: |
53+
tar -czvf ${{ github.workspace }}/${{ inputs.artifact-name }} ${{ github.workspace }}/nuget
54+
55+
- id: get_version
56+
uses: ./.github/actions/get-version
57+
58+
- name: Run RL Scanner
59+
id: rl-scan-conclusion
60+
uses: ./.github/actions/rl-scanner
61+
with:
62+
artifact-path: ${{ github.workspace }}/${{ inputs.artifact-name }}
63+
version: "${{ steps.get_version.outputs.version }}"
64+
env:
65+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
66+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
67+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
68+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
69+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
70+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
71+
72+
- name: Output scan result
73+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

0 commit comments

Comments
 (0)