Skip to content

Commit 01e9fc7

Browse files
ausbru87ausbru87
authored
Add automated security scanning workflows (#124)
* ci: add security scanning workflows (#123) * ci: scan for all CVE severity levels and remove Docker image scan - Scan LOW,MEDIUM,HIGH,CRITICAL instead of only HIGH,CRITICAL - Remove Docker image scan (no :latest tag exists) * ci: add explicit scanners to Trivy configuration Enable vuln, secret, and misconfig scanners explicitly * ci: build and scan Docker image like coder/coder - Build Go binary for linux/amd64 - Build Docker image with buildx - Scan the built image (not filesystem) - Matches coder/coder scanning approach * ci: add table output and artifact upload for scan visibility - Add table format scan to show results in workflow logs - Upload SARIF as artifact for manual inspection - Matches coder/coder artifact upload pattern * ci: add workflow_dispatch trigger to scorecard for manual testing * revert: remove workflow_dispatch from scorecard * removed changes from changelog.md * updated Make for multiple targets and updated security.yaml to use make and bake. * added sha pinning * Updated SHAs scorecard.yml:24: actions/checkout → v5.0.0 scorecard.yml:29: ossf/scorecard-action → v2.4.3 security.yaml:32: actions/checkout → v5.0.0 (CodeQL job) security.yaml:57: actions/checkout → v5.0.0 (Trivy job) security.yaml:81: aquasecurity/trivy-action → v0.33.1 security.yaml:88: aquasecurity/trivy-action → v0.33.1 * added explicit build targets for each arch removed PHONY alias added wildcard for .go files updated security workflow to use explicit build target vs old alias * added explicit make build command instead of alias to security workflow * removed prefixes due to changelog.md being manually curated removed patch ignore and instead we are grouping all-dependencies updates weekly * reduce potential of credential leak by removing credential persistence * address review comments: refactor Makefile and move dev docs to CONTRIBUTING.md - Use $(shell find) instead of wildcard for Go files (deansheather) - Extract mkdir -p bin to top-level (deansheather) - Create LDFLAGS variable for build flags (deansheather) - Move Development section from README.md to CONTRIBUTING.md (code-asher) * rename mac -> darwin and quote $@ in build targets
1 parent 2e4fd81 commit 01e9fc7

8 files changed

Lines changed: 219 additions & 10 deletions

File tree

‎.CONTRIBUTING.md.swp‎

12 KB
Binary file not shown.

‎.github/dependabot.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,6 @@ updates:
2121
labels: []
2222
open-pull-requests-limit: 15
2323
groups:
24-
x:
24+
all-dependencies:
2525
patterns:
26-
- "golang.org/x/*"
26+
- "*"

‎.github/workflows/scorecard.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: OpenSSF Scorecard
2+
3+
on:
4+
branch_protection_rule:
5+
schedule:
6+
# Run weekly on Wednesdays at 7:27 UTC
7+
- cron: "27 7 * * 3"
8+
push:
9+
branches:
10+
- main
11+
12+
permissions: read-all
13+
14+
jobs:
15+
analysis:
16+
name: Scorecard analysis
17+
runs-on: ubuntu-latest
18+
permissions:
19+
security-events: write
20+
id-token: write
21+
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
25+
with:
26+
persist-credentials: false
27+
28+
- name: Run analysis
29+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
30+
with:
31+
results_file: results.sarif
32+
results_format: sarif
33+
repo_token: ${{ secrets.GITHUB_TOKEN }}
34+
publish_results: true
35+
36+
- name: Upload artifact
37+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
38+
with:
39+
name: SARIF file
40+
path: results.sarif
41+
retention-days: 5
42+
43+
- name: Upload to code-scanning
44+
uses: github/codeql-action/upload-sarif@755f44910c12a3d7ca0d8c6e42c048b3362f7cec # v3.30.8
45+
with:
46+
sarif_file: results.sarif

‎.github/workflows/security.yaml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: security
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
schedule:
9+
# Run every day at 10:00 UTC (6:00 AM ET / 3:00 AM PT)
10+
- cron: "0 10 * * *"
11+
workflow_dispatch:
12+
13+
permissions:
14+
contents: read
15+
16+
# Cancel in-progress runs for pull requests when developers push
17+
# additional changes
18+
concurrency:
19+
group: ${{ github.workflow }}-${{ github.ref }}
20+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
21+
22+
jobs:
23+
codeql:
24+
name: CodeQL Analysis
25+
runs-on: ubuntu-latest
26+
permissions:
27+
security-events: write
28+
actions: read
29+
contents: read
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
with:
34+
persist-credentials: false
35+
36+
- name: Setup Go
37+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
38+
with:
39+
go-version-file: "go.mod"
40+
41+
- name: Initialize CodeQL
42+
uses: github/codeql-action/init@755f44910c12a3d7ca0d8c6e42c048b3362f7cec # v3.30.8
43+
with:
44+
languages: go
45+
46+
- name: Perform CodeQL Analysis
47+
uses: github/codeql-action/analyze@755f44910c12a3d7ca0d8c6e42c048b3362f7cec # v3.30.8
48+
with:
49+
category: "/language:go"
50+
51+
trivy:
52+
name: Trivy Docker Image Scan
53+
runs-on: ubuntu-latest
54+
permissions:
55+
security-events: write
56+
contents: read
57+
steps:
58+
- name: Checkout repository
59+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
60+
with:
61+
persist-credentials: false
62+
63+
- name: Setup Go
64+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
65+
with:
66+
go-version-file: "go.mod"
67+
68+
- name: Build binary for linux/amd64
69+
run: make bin/code-marketplace-linux-amd64
70+
71+
- name: Set up Docker Buildx
72+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
73+
74+
- name: Build Docker image
75+
id: build
76+
run: |
77+
docker buildx bake \
78+
-f ./docker-bake.hcl \
79+
--set "*.platform=linux/amd64" \
80+
--set "*.tags=code-marketplace:scan" \
81+
--load
82+
echo "image=code-marketplace:scan" >> "$GITHUB_OUTPUT"
83+
84+
- name: Run Trivy vulnerability scanner (table output for logs)
85+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
86+
with:
87+
image-ref: ${{ steps.build.outputs.image }}
88+
format: "table"
89+
severity: "LOW,MEDIUM,HIGH,CRITICAL"
90+
91+
- name: Run Trivy vulnerability scanner (SARIF output for GitHub)
92+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
93+
with:
94+
image-ref: ${{ steps.build.outputs.image }}
95+
format: "sarif"
96+
output: "trivy-results.sarif"
97+
severity: "LOW,MEDIUM,HIGH,CRITICAL"
98+
99+
- name: Upload Trivy scan results to GitHub Security tab
100+
uses: github/codeql-action/upload-sarif@755f44910c12a3d7ca0d8c6e42c048b3362f7cec # v3.30.8
101+
with:
102+
sarif_file: "trivy-results.sarif"
103+
category: "Trivy"
104+
105+
- name: Upload Trivy scan results as artifact
106+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
107+
with:
108+
name: trivy-results
109+
path: trivy-results.sarif
110+
retention-days: 7

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## Unreleased
99

10+
### Changed
11+
1012
- Update the Kubernetes Deployment `spec.strategy.type` field to be of type `Recreate`
1113
in order to properly handle upgrades/restarts as the default deployment creates a PVC
1214
of type `ReadWriteOnce` and could only be assigned to one replica.

‎CONTRIBUTING.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,35 @@
22

33
## Development
44

5+
### Requirements
6+
7+
- Go 1.21 or later
8+
- GNU Make
9+
10+
### Building from source
11+
12+
Build all platform binaries:
13+
14+
```console
15+
make build
16+
```
17+
18+
Build a specific platform:
19+
20+
```console
21+
make bin/code-marketplace-linux-amd64
22+
```
23+
24+
Available targets:
25+
- `bin/code-marketplace-darwin-amd64`
26+
- `bin/code-marketplace-darwin-arm64`
27+
- `bin/code-marketplace-linux-amd64`
28+
- `bin/code-marketplace-linux-arm64`
29+
- `bin/code-marketplace-windows-amd64`
30+
- `bin/code-marketplace-windows-arm64`
31+
32+
### Running locally
33+
534
```console
635
mkdir extensions
736
go run ./cmd/marketplace/main.go server --extensions-dir ./extensions

‎Makefile‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,34 @@ upload:
2626
.PHONY: gen
2727

2828
TAG=$(shell git describe --always)
29+
GO_SRC=$(shell find . -name '*.go' -type f)
30+
LDFLAGS=-ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)"
31+
$(shell mkdir -p bin)
2932

30-
build:
31-
CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-mac-amd64 ./cmd/marketplace/main.go
32-
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-mac-arm64 ./cmd/marketplace/main.go
33-
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-amd64 ./cmd/marketplace/main.go
34-
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-arm64 ./cmd/marketplace/main.go
35-
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-amd64 ./cmd/marketplace/main.go
36-
CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-arm64 ./cmd/marketplace/main.go
33+
# Individual build targets for each OS/arch combination
34+
bin/code-marketplace-darwin-amd64: $(GO_SRC) go.mod go.sum
35+
CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build $(LDFLAGS) -o "$@" ./cmd/marketplace/main.go
36+
37+
bin/code-marketplace-darwin-arm64: $(GO_SRC) go.mod go.sum
38+
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build $(LDFLAGS) -o "$@" ./cmd/marketplace/main.go
39+
40+
bin/code-marketplace-linux-amd64: $(GO_SRC) go.mod go.sum
41+
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build $(LDFLAGS) -o "$@" ./cmd/marketplace/main.go
42+
43+
bin/code-marketplace-linux-arm64: $(GO_SRC) go.mod go.sum
44+
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build $(LDFLAGS) -o "$@" ./cmd/marketplace/main.go
45+
46+
bin/code-marketplace-windows-amd64: $(GO_SRC) go.mod go.sum
47+
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build $(LDFLAGS) -o "$@" ./cmd/marketplace/main.go
48+
49+
bin/code-marketplace-windows-arm64: $(GO_SRC) go.mod go.sum
50+
CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build $(LDFLAGS) -o "$@" ./cmd/marketplace/main.go
51+
52+
# Main build target - builds all platforms
53+
build: bin/code-marketplace-darwin-amd64 \
54+
bin/code-marketplace-darwin-arm64 \
55+
bin/code-marketplace-linux-amd64 \
56+
bin/code-marketplace-linux-arm64 \
57+
bin/code-marketplace-windows-amd64 \
58+
bin/code-marketplace-windows-arm64
3759
.PHONY: build

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ using code-marketplace with VS Code and VSCodium:
219219

220220
- [VSCodium](https://github.com/VSCodium/vscodium/blob/master/docs/index.md#howto-switch-marketplace)
221221

222-
```
222+
```console
223223
export VSCODE_GALLERY_SERVICE_URL="https://<domain>/api
224224
export VSCODE_GALLERY_ITEM_URL="https://<domain>/item"
225225
# Or set a product.json file in `~/.config/VSCodium/product.json`

0 commit comments

Comments
 (0)