Skip to content

Commit ec9d1df

Browse files
ezhang6811ezhang6811
committed
add daily scan
1 parent 849fcd6 commit ec9d1df

1 file changed

Lines changed: 143 additions & 0 deletions

File tree

‎.github/workflows/daily-scan.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
## Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: Apache-2.0
3+
# Performs a daily scan of:
4+
# * The X-Ray Python SDK source code, using Trivy
5+
# * Project dependencies, using DependencyCheck
6+
#
7+
# Publishes results to CloudWatch Metrics.
8+
name: Daily scan
9+
10+
on:
11+
schedule:
12+
- cron: '0 18 * * *' # scheduled to run at 18:00 UTC every day
13+
workflow_dispatch: # be able to run the workflow on demand
14+
push:
15+
branches:
16+
- zhaez/scanner
17+
18+
env:
19+
AWS_DEFAULT_REGION: us-east-1
20+
21+
permissions:
22+
id-token: write
23+
contents: read
24+
25+
jobs:
26+
scan_and_report:
27+
runs-on: ubuntu-latest
28+
steps:
29+
- name: Checkout repo for dependency scan
30+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #5.0.0
31+
with:
32+
fetch-depth: 0
33+
34+
- name: Setup Python for dependency scan
35+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b #v5.3.0
36+
with:
37+
python-version: '3.x'
38+
39+
- name: Build Python project for scanning
40+
run: |
41+
python -m venv scan-venv
42+
source scan-venv/bin/activate
43+
# Install the published SDK package to get all runtime dependencies
44+
pip install aws-xray-sdk
45+
# Generate requirements file for scanning
46+
pip freeze > requirements.txt
47+
48+
- name: Install Java for dependency scan
49+
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 #v5.0.0
50+
with:
51+
java-version: 17
52+
distribution: 'temurin'
53+
54+
- name: Configure AWS credentials for dependency scan
55+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #5.0.0
56+
with:
57+
role-to-assume: ${{ secrets.SECRET_MANAGER_ROLE_ARN }}
58+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
59+
60+
- name: Get NVD API key for dependency scan
61+
uses: aws-actions/aws-secretsmanager-get-secrets@a9a7eb4e2f2871d30dc5b892576fde60a2ecc802 #v2.0.10
62+
id: nvd_api_key
63+
with:
64+
secret-ids: ${{ secrets.NVD_API_KEY_SECRET_ARN }}
65+
parse-json-secrets: true
66+
67+
# See http://jeremylong.github.io/DependencyCheck/dependency-check-cli/ for installation explanation
68+
- name: Install and run dependency scan
69+
id: dep_scan
70+
if: always()
71+
run: |
72+
# Install dependency-check
73+
gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 259A55407DD6C00299E6607EFFDE55BE73A2D1ED
74+
VERSION=$(curl -s https://jeremylong.github.io/DependencyCheck/current.txt | head -n1 | cut -d" " -f1)
75+
curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip" --output dependency-check.zip
76+
curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip.asc" --output dependency-check.zip.asc
77+
gpg --verify dependency-check.zip.asc
78+
unzip dependency-check.zip
79+
80+
# Run dependency check on entire workspace
81+
./dependency-check/bin/dependency-check.sh \
82+
--failOnCVSS 0 \
83+
--nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} \
84+
--disableOssIndex \
85+
--enableExperimental \
86+
-s "." \
87+
--format HTML \
88+
--format JSON
89+
90+
- name: Print dependency scan results on failure
91+
if: always()
92+
run: |
93+
if [ "${{ steps.dep_scan.outcome }}" != "success" ]; then
94+
less dependency-check-report.html
95+
fi
96+
97+
- name: Perform high severity scan on built artifacts
98+
if: always()
99+
id: high_scan_latest
100+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 #v0.33.1
101+
with:
102+
scan-type: 'fs'
103+
scan-ref: '.'
104+
severity: 'CRITICAL,HIGH'
105+
exit-code: '1'
106+
scanners: 'vuln'
107+
108+
- name: Perform low severity scan on built artifacts
109+
if: always()
110+
id: low_scan_latest
111+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 #v0.33.1
112+
with:
113+
scan-type: 'fs'
114+
scan-ref: '.'
115+
severity: 'MEDIUM,LOW,UNKNOWN'
116+
exit-code: '1'
117+
scanners: 'vuln'
118+
119+
- name: Configure AWS Credentials for emitting metrics
120+
if: always()
121+
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 #5.0.0
122+
with:
123+
role-to-assume: ${{ secrets.AWS_INTEG_TEST_ROLE_ARN }}
124+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
125+
126+
- name: Publish high scan status
127+
if: always()
128+
run: |
129+
value="${{ steps.high_scan_latest.outcome == 'success' && '0' || '1' }}"
130+
aws cloudwatch put-metric-data --metric-name XRayPythonSDKSecurityScanHighSeverityFailures --dimensions failure=rate --namespace MonitorSDK --value $value --timestamp $(date +%s)
131+
132+
- name: Publish low scan status
133+
if: always()
134+
run: |
135+
value="${{ steps.low_scan_latest.outcome == 'success' && steps.dep_scan.outcome == 'success' && '0' || '1' }}"
136+
aws cloudwatch put-metric-data --metric-name XRayPythonSDKSecurityScanLowSeverityFailures --dimensions failure=rate --namespace MonitorSDK --value $value --timestamp $(date +%s)
137+
138+
- name: Cleanup
139+
if: always()
140+
run: |
141+
rm -f ./dependency-check.zip
142+
rm -f ./dependency-check.zip.asc
143+
rm -rf ./dependency-check || true

0 commit comments

Comments
 (0)