Skip to content

Commit 8b74bda

Browse files
ekharkunovekharkunov
committed
Added Semgrep scanning
1 parent 2860779 commit 8b74bda

4 files changed

Lines changed: 56 additions & 25 deletions

File tree

‎.github/workflows/application-build.yml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-22.04
1919
steps:
2020
- name: Checkout repo
21-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2222
- name: Generate version
2323
id: version
2424
run: |
@@ -29,19 +29,19 @@ jobs:
2929
echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
3030
echo "COMMIT_SHORT_SHA=$SHORT_SHA" >> $GITHUB_ENV
3131
- name: Login to Google Artifact registry (Maven)
32-
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
32+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
3333
with:
3434
service_account: ${{ env.MAVEN_SERVICE_ACCOUNT }}
3535
credentials_json: ${{ secrets.MAVEN_REGISTRY_JSON_KEY }}
3636
export_environment_variables: true
3737
create_credentials_file: true
3838
- name: Install Java
39-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
39+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
4040
with:
4141
java-version: '25'
4242
distribution: 'temurin'
4343
- name: Setup Gradle
44-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2
44+
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
4545
- name: Build the extender-client.jar
4646
run: ./gradlew -PpublishToGar -PclientVersion=${{ steps.version.outputs.tag_version }} client:jar
4747
- name: Test the extender-client.jar
@@ -63,7 +63,7 @@ jobs:
6363
--target ${{ github.sha }} \
6464
${{ github.workspace }}/gh_release/*.jar
6565
- name: Notify if tests failed
66-
uses: homoluctus/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
66+
uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
6767
if: failure()
6868
with:
6969
type: ${{ job.status }}
@@ -76,7 +76,7 @@ jobs:
7676
runs-on: ubuntu-22.04
7777
steps:
7878
- name: Checkout repo
79-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
79+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8080
- name: Generate version
8181
id: version
8282
run: |
@@ -87,19 +87,19 @@ jobs:
8787
echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
8888
echo "COMMIT_SHORT_SHA=$SHORT_SHA" >> $GITHUB_ENV
8989
- name: Login to Google Artifact registry (Maven)
90-
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
90+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
9191
with:
9292
service_account: ${{ env.MAVEN_SERVICE_ACCOUNT }}
9393
credentials_json: ${{ secrets.MAVEN_REGISTRY_JSON_KEY }}
9494
export_environment_variables: true
9595
create_credentials_file: true
9696
- name: Install Java
97-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
97+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
9898
with:
9999
java-version: '25'
100100
distribution: 'temurin'
101101
- name: Setup Gradle
102-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2
102+
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
103103
- name: Build manifestmerger
104104
run: ./gradlew -PpublishToGar -PmanifestMergetoolVersion=${{ steps.version.outputs.tag_version }} :manifestmergetool:mainJar
105105
- name: Test manifestmerger
@@ -121,7 +121,7 @@ jobs:
121121
--target ${{ github.sha }} \
122122
${{ github.workspace }}/gh_release/*.jar
123123
- name: Notify if tests failed
124-
uses: homoluctus/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
124+
uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
125125
if: failure()
126126
with:
127127
type: ${{ job.status }}
@@ -135,7 +135,7 @@ jobs:
135135
steps:
136136
# cleanup disk space because we use lots of disk space for Docker image during extender tests
137137
- name: Free Disk Space (Ubuntu)
138-
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be
138+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
139139
with:
140140
# this might remove tools that are actually needed,
141141
# if set to "true" but frees about 6 GB
@@ -150,7 +150,7 @@ jobs:
150150
docker-images: true
151151
swap-storage: true
152152
- name: Checkout repo
153-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
153+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
154154
- name: Generate version
155155
id: version
156156
run: |
@@ -161,12 +161,12 @@ jobs:
161161
echo "tag_version=$TAG_VERSION" >> $GITHUB_OUTPUT
162162
echo "COMMIT_SHORT_SHA=$SHORT_SHA" >> $GITHUB_ENV
163163
- name: Install Java
164-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
164+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
165165
with:
166166
java-version: '25'
167167
distribution: 'temurin'
168168
- name: Setup Gradle
169-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2
169+
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
170170
- name: Build extender
171171
run: ./gradlew -PextenderVersion=${{ steps.version.outputs.tag_version }} server:bootJar
172172
- name: Login to Google Artifact registry (Docker)
@@ -183,7 +183,7 @@ jobs:
183183
- name: Run extender tests
184184
run: ./gradlew -PextenderVersion=${{ steps.version.outputs.tag_version }} server:test -i
185185
- name: Login to Google Artifact registry (Maven)
186-
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
186+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
187187
with:
188188
service_account: ${{ env.MAVEN_SERVICE_ACCOUNT }}
189189
credentials_json: ${{ secrets.MAVEN_REGISTRY_JSON_KEY }}
@@ -207,13 +207,13 @@ jobs:
207207
${{ github.workspace }}/gh_release/*.jar
208208
- name: Upload test results
209209
if: always()
210-
uses: actions/upload-artifact@v6.0.0
210+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
211211
with:
212212
name: test-result
213213
path: ${{ github.workspace }}/server/build/reports/tests/
214214
retention-days: 10
215215
- name: Notify if tests failed
216-
uses: homoluctus/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
216+
uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
217217
if: failure()
218218
with:
219219
type: ${{ job.status }}

‎.github/workflows/code-coverage.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,23 @@ jobs:
1010
runs-on: ubuntu-22.04
1111
steps:
1212
- name: Checkout repo
13-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1414
- name: Install Java
15-
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
15+
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
1616
with:
1717
java-version: '25'
1818
distribution: 'temurin'
1919
- name: Setup Gradle
20-
uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2
20+
uses: gradle/actions/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
2121
- name: Run extender tests
2222
run: ./gradlew server:clean server:test server:jacocoTestReport -PexcludeTags="integration" -i
2323
- name: Setup .NET Core # Required to execute ReportGenerator
24-
uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309
24+
uses: actions/setup-dotnet@baa11fbfe1d6520db94683bd5c7a3818018e4309 # v5.1.0
2525
with:
2626
dotnet-version: 8.x
2727
dotnet-quality: 'ga'
2828
- name: ReportGenerator
29-
uses: danielpalme/ReportGenerator-GitHub-Action@4c0f60daf67483745c34efdeadd4c4e78a19991e3
29+
uses: danielpalme/ReportGenerator-GitHub-Action@ee0ae774f6d3afedcbd1683c1ab21b83670bdf8e # 5.5.1
3030
with:
3131
reports: '${{ github.workspace }}/server/build/reports/jacoco/test/jacocoTestReport.xml' # REQUIRED # The coverage reports that should be parsed (separated by semicolon). Globbing is supported.
3232
targetdir: 'coveragereport' # REQUIRED # The directory where the generated report should be saved.
@@ -48,13 +48,13 @@ jobs:
4848
toolpath: 'reportgeneratortool' # Default directory for installing the dotnet tool.
4949
- name: Upload test results
5050
if: always()
51-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
51+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
5252
with:
5353
name: test-result
5454
path: ${{ github.workspace }}/server/build/reports/tests/
5555
retention-days: 10
5656
- name: Upload coverage report artifact
57-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
57+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
5858
with:
5959
name: CoverageReport # Artifact name
6060
path: coveragereport # Directory containing files to upload

‎.github/workflows/docker-env-build.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ jobs:
118118
${{ steps.name_postprocess.outputs.target_registry }}/extender-${{ steps.name_postprocess.outputs.image_name }}-env:latest
119119
120120
- name: Notify if tests failed
121-
uses: homoluctus/slatify@master
121+
uses: lazy-actions/slatify@cd4b4a1158cfb3e26fe1ee35c1cd4f0247dfbf96
122122
if: failure()
123123
with:
124124
type: ${{ job.status }}

‎.github/workflows/semgrep-scanning.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Semgrep Code Scanning
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 2 * * MON"
7+
8+
jobs:
9+
semgrep_scan:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout repository
14+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
15+
16+
- name: Install Semgrep
17+
run: |
18+
python3 -m pip install semgrep
19+
20+
- name: Run Semgrep Scan
21+
run: |
22+
semgrep scan \
23+
--config p/java \
24+
--config p/security-audit \
25+
--sarif \
26+
--output semgrep-java-scan.sarif
27+
28+
- name: Upload SARIF to Code Scanning
29+
uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # 4.32.0
30+
with:
31+
sarif_file: semgrep-java-scan.sarif

0 commit comments

Comments
 (0)