Skip to content

Commit 23e05c1

Browse files
refoo0refoo0
committed
Merge remote-tracking branch 'origin/main' into feature/webhook-events
2 parents 0fc2d5d + 6793bf7 commit 23e05c1

64 files changed

Lines changed: 3372 additions & 1422 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env.example‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ INSTANCE_DOMAIN=https://api.main.devguard.org #Choose which version of devguar
1616

1717
FRONTEND_URL=http://localhost:3000
1818

19+
OSI_LICENSES_API=https://opensource.org/api/license/
20+
1921
PDF_GENERATION_API=https://dwt-api.dev-l3montree.cloud/pdf
2022
# comment to disable error tracking
2123
ERROR_TRACKING_DSN="https://<your-error-tracking-dsn>"

‎.github/workflows/devguard-scanner.yaml‎

Lines changed: 21 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -8,42 +8,6 @@ on:
88

99

1010
jobs:
11-
# Secret scanning job to detect secrets in codebase
12-
secret-scanning:
13-
uses: l3montree-dev/devguard-action/.github/workflows/secret-scanning.yml@main
14-
with:
15-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
16-
api-url: https://api.main.devguard.org
17-
secrets:
18-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
19-
20-
# Secret scanning job to detect secrets in codebase
21-
iac:
22-
uses: l3montree-dev/devguard-action/.github/workflows/iac.yml@main
23-
with:
24-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
25-
api-url: https://api.main.devguard.org
26-
secrets:
27-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
28-
29-
sast:
30-
uses: l3montree-dev/devguard-action/.github/workflows/sast.yml@main
31-
with:
32-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
33-
api-url: https://api.main.devguard.org
34-
secrets:
35-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
36-
37-
sca:
38-
uses: l3montree-dev/devguard-action/.github/workflows/software-composition-analysis.yml@main
39-
with:
40-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
41-
api-url: https://api.main.devguard.org
42-
fail-on-risk: high
43-
fail-on-cvss: high
44-
secrets:
45-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
46-
4711
golangci:
4812
name: lint
4913
runs-on: ubuntu-latest
@@ -83,158 +47,81 @@ jobs:
8347
name: code-coverage
8448
path: coverage.out
8549

86-
# Docker image build job
87-
build-image:
88-
uses: l3montree-dev/devguard-action/.github/workflows/build-image.yml@main
50+
51+
devguard:
52+
uses: l3montree-dev/devguard-action/.github/workflows/full.yml@main
8953
with:
9054
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
9155
api-url: https://api.main.devguard.org
56+
fail-on-risk: high
57+
fail-on-cvss: high
58+
should-deploy: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
9259
secrets:
93-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
94-
build-args: "--context=. --dockerfile=Dockerfile --build-arg GITHUB_REF_NAME=$GITHUB_REF_NAME"
60+
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
61+
build-args: "--context=. --dockerfile=Dockerfile --build-arg GITHUB_REF_NAME=$GITHUB_REF_NAME"
62+
9563

9664
build-scanner-image:
9765
uses: l3montree-dev/devguard-action/.github/workflows/build-image.yml@main
9866
with:
99-
image-suffix: "-scanner"
100-
artifact-suffix: "-scanner"
101-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
67+
artifact-name: "scanner"
68+
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
10269
api-url: https://api.main.devguard.org
10370
secrets:
10471
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
10572
build-args: "--context=. --dockerfile=Dockerfile.scanner"
10673

107-
# Image scanning job to detect vulnerabilities in the built Docker image
108-
container-scanning:
109-
uses: l3montree-dev/devguard-action/.github/workflows/container-scanning.yml@main
110-
needs:
111-
- build-image
112-
with:
113-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
114-
api-url: https://api.main.devguard.org
115-
fail-on-risk: high
116-
fail-on-cvss: high
117-
secrets:
118-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
11974

12075
# Image scanning job to detect vulnerabilities in the built Docker image
12176
scanner-container-scanning:
12277
uses: l3montree-dev/devguard-action/.github/workflows/container-scanning.yml@main
12378
needs:
12479
- build-scanner-image
125-
with:
126-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
127-
api-url: https://api.main.devguard.org
128-
artifact-suffix: "-scanner"
129-
secrets:
130-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
131-
132-
deploy:
133-
needs:
134-
- build-image
135-
- container-scanning
136-
- secret-scanning
137-
- sca
138-
- sast
139-
- golangci
140-
- tests
141-
- iac
142-
uses: l3montree-dev/devguard-action/.github/workflows/deploy.yml@main
143-
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
14480
with:
14581
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
14682
api-url: https://api.main.devguard.org
83+
artifact-name: "scanner"
14784
secrets:
14885
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
149-
86+
15087
deploy-scanner:
15188
needs:
15289
- build-scanner-image
15390
- scanner-container-scanning
154-
- secret-scanning
155-
- sca
156-
- sast
157-
- golangci
158-
- tests
159-
- iac
91+
- devguard
16092
uses: l3montree-dev/devguard-action/.github/workflows/deploy.yml@main
16193
with:
162-
artifact-suffix: "-scanner"
163-
image-suffix: "-scanner"
94+
artifact-name: "scanner"
16495
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
16596
api-url: https://api.main.devguard.org
16697
secrets:
16798
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
16899
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/troubleshooting-sast'
169100

170-
sign:
171-
needs:
172-
- build-image
173-
- container-scanning
174-
- secret-scanning
175-
- sca
176-
- sast
177-
- golangci
178-
- tests
179-
- iac
180-
uses: l3montree-dev/devguard-action/.github/workflows/sign.yml@main
181-
with:
182-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
183-
api-url: https://api.main.devguard.org
184-
secrets:
185-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
186-
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
187101

188102
sign-scanner:
189103
needs:
190104
- build-scanner-image
191105
- scanner-container-scanning
192-
- secret-scanning
193-
- sca
194-
- sast
195-
- golangci
196-
- tests
197-
- iac
106+
- devguard
198107
uses: l3montree-dev/devguard-action/.github/workflows/sign.yml@main
199-
with:
200-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
201-
api-url: https://api.main.devguard.org
202-
artifact-suffix: "-scanner"
203-
secrets:
204-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
205-
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
206-
207-
attest:
208-
needs:
209-
- build-image
210-
- container-scanning
211-
- secret-scanning
212-
- sca
213-
- sast
214-
- golangci
215-
- tests
216-
- iac
217-
uses: l3montree-dev/devguard-action/.github/workflows/attest.yml@main
218108
with:
219109
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
220110
api-url: https://api.main.devguard.org
111+
artifact-name: "scanner"
221112
secrets:
222113
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
114+
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
223115

224116
attest-scanner:
225117
needs:
226118
- build-scanner-image
227119
- scanner-container-scanning
228-
- secret-scanning
229-
- sca
230-
- sast
231-
- golangci
232-
- tests
233-
- iac
120+
- devguard
234121
uses: l3montree-dev/devguard-action/.github/workflows/attest.yml@main
235122
with:
236-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
123+
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
237124
api-url: https://api.main.devguard.org
238-
artifact-suffix: "-scanner"
125+
artifact-name: "scanner"
239126
secrets:
240127
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

‎.kratos/kratos.docker-compose-try-it.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
version: v0.13.0
2+
3+
dsn: memory
4+
5+
session:
6+
cookie:
7+
name: ory_kratos_session
8+
9+
serve:
10+
public:
11+
base_url: http://localhost:4433/
12+
cors:
13+
enabled: true
14+
admin:
15+
base_url: http://localhost:4434/
16+
17+
selfservice:
18+
default_browser_return_url: http://localhost:3000/
19+
allowed_return_urls:
20+
- http://localhost:3000
21+
methods:
22+
password:
23+
enabled: true
24+
totp:
25+
config:
26+
issuer: Kratos
27+
enabled: true
28+
lookup_secret:
29+
enabled: true
30+
link:
31+
enabled: true
32+
code:
33+
enabled: true
34+
passkey:
35+
enabled: true
36+
config:
37+
rp:
38+
# This MUST be your root domain (not a subdomain)
39+
id: localhost:3000
40+
# This MUST be the exact URL of the page which will prompt for WebAuthn!
41+
# Only the scheme (https / http), host (auth.example.org), and port (4455) are relevant. The
42+
# path is irrelevant.
43+
origins:
44+
- http://localhost:3000
45+
# A display name which will be shown to the user on her/his device.
46+
display_name: DevGuard
47+
flows:
48+
error:
49+
ui_url: http://localhost:3000/error
50+
51+
settings:
52+
ui_url: http://localhost:3000/user-settings
53+
privileged_session_max_age: 15m
54+
required_aal: highest_available
55+
56+
recovery:
57+
enabled: true
58+
ui_url: http://localhost:3000/recovery
59+
use: code
60+
61+
verification:
62+
enabled: true
63+
ui_url: http://localhost:3000/verification
64+
use: code
65+
after:
66+
default_browser_return_url: http://localhost:3000/
67+
68+
logout:
69+
after:
70+
default_browser_return_url: http://localhost:3000/login
71+
72+
login:
73+
ui_url: http://localhost:3000/login
74+
lifespan: 10m
75+
76+
registration:
77+
lifespan: 10m
78+
ui_url: http://localhost:3000/registration
79+
after:
80+
password:
81+
hooks:
82+
- hook: session
83+
84+
log:
85+
level: debug
86+
format: text
87+
leak_sensitive_values: true
88+
89+
secrets:
90+
cookie:
91+
- PLEASE-CHANGE-ME-I-AM-VERY-INSECURE
92+
cipher:
93+
- 32-LONG-SECRET-NOT-SECURE-AT-ALL
94+
95+
ciphers:
96+
algorithm: xchacha20-poly1305
97+
98+
hashers:
99+
algorithm: bcrypt
100+
bcrypt:
101+
cost: 8
102+
103+
identity:
104+
default_schema_id: default
105+
schemas:
106+
- id: default
107+
url: file:///etc/config/kratos/identity.schema.json
108+
109+
courier:
110+
smtp:
111+
connection_uri: smtps://test:test@mailslurper:1025/?skip_ssl_verify=true
112+
from_address: noreply@devguard.org
113+
from_name: DevGuard

‎cmd/devguard-cli/commands/components.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55

66
"github.com/l3montree-dev/devguard/internal/core"
77
"github.com/l3montree-dev/devguard/internal/core/component"
8+
"github.com/l3montree-dev/devguard/internal/core/vuln"
89
"github.com/l3montree-dev/devguard/internal/core/vulndb"
910
"github.com/l3montree-dev/devguard/internal/database/models"
1011
"github.com/l3montree-dev/devguard/internal/database/repositories"
@@ -37,6 +38,7 @@ func newUpdateDepsDevInformation() *cobra.Command {
3738
depsDevService := vulndb.NewDepsDevService()
3839
componentProjectRepository := repositories.NewComponentProjectRepository(database)
3940
componentRepository := repositories.NewComponentRepository(database)
41+
licenseRiskService := vuln.NewLicenseRiskService(repositories.NewLicenseRiskRepository(database), repositories.NewVulnEventRepository(database))
4042

4143
components, err := componentRepository.All()
4244
if err != nil {
@@ -48,6 +50,7 @@ func newUpdateDepsDevInformation() *cobra.Command {
4850
&depsDevService,
4951
componentProjectRepository,
5052
componentRepository,
53+
licenseRiskService,
5154
)
5255

5356
bar := progressbar.Default(int64(len(components)))

0 commit comments

Comments
 (0)