Skip to content

Commit 61f82b9

Browse files
Hubtrick-GitHubtrick-Git
committed
Merge remote-tracking branch 'origin/main' into refactor-vuln-events-table
2 parents b92691c + c10a9a4 commit 61f82b9

36 files changed

Lines changed: 4457 additions & 650 deletions

‎.github/workflows/devguard-scanner.yaml‎

Lines changed: 28 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,11 @@ jobs:
5252
path: coverage.out
5353

5454

55-
devguard:
56-
uses: l3montree-dev/devguard-action/.github/workflows/full.yml@main
55+
code-scanning:
56+
uses: l3montree-dev/devguard-action/.github/workflows/code-scanning.yml@nix
5757
permissions:
58-
contents: write
59-
actions: read
58+
contents: read
6059
security-events: write
61-
packages: write
6260
with:
6361
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
6462
api-url: https://api.main.devguard.org
@@ -67,91 +65,52 @@ jobs:
6765
web-ui: https://main.devguard.org
6866
continue-on-open-code-risk: true
6967
secrets:
70-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
71-
build-args: "--context=. --dockerfile=Dockerfile --build-arg GITHUB_REF_NAME=$GITHUB_REF_NAME --build-arg GITHUB_SHA=$GITHUB_SHA"
68+
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
7269

7370

74-
build-scanner-image:
75-
uses: l3montree-dev/devguard-action/.github/workflows/build-image.yml@main
71+
api-pipeline:
72+
uses: l3montree-dev/devguard-action/.github/workflows/full-nix.yml@nix
7673
permissions:
7774
contents: read
7875
packages: write
79-
with:
80-
artifact-name: "pkg:oci/scanner?repository_url=ghcr.io/l3montree-dev/devguard/scanner"
81-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
82-
api-url: https://api.main.devguard.org
83-
image-suffix: "scanner"
84-
secrets:
85-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
86-
build-args: "--context=. --dockerfile=Dockerfile.scanner --build-arg GITHUB_REF_NAME=$GITHUB_REF_NAME --build-arg GITHUB_SHA=$GITHUB_SHA"
87-
88-
89-
# Image scanning job to detect vulnerabilities in the built Docker image
90-
scanner-container-scanning:
91-
uses: l3montree-dev/devguard-action/.github/workflows/container-scanning.yml@main
92-
permissions:
93-
contents: read
9476
security-events: write
95-
needs:
96-
- build-scanner-image
9777
with:
78+
nix-target-amd64: devguard-amd64
79+
nix-target-arm64: devguard-arm64
80+
image-name: ghcr.io/${{ github.repository }}
9881
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
9982
api-url: https://api.main.devguard.org
100-
artifact-name: "pkg:oci/scanner?repository_url=ghcr.io/l3montree-dev/devguard/scanner"
10183
web-ui: https://main.devguard.org
10284
fail-on-cvss: high
10385
fail-on-risk: high
104-
image-suffix: "scanner"
105-
secrets:
106-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
107-
108-
deploy-scanner:
109-
needs:
110-
- build-scanner-image
111-
- scanner-container-scanning
112-
- tests
113-
uses: l3montree-dev/devguard-action/.github/workflows/deploy.yml@main
114-
permissions:
115-
contents: read
116-
packages: write
117-
with:
118-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
119-
api-url: https://api.main.devguard.org
120-
image-suffix: "scanner"
121-
secrets:
122-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
123-
124-
sign-scanner:
125-
needs:
126-
- build-scanner-image
127-
- scanner-container-scanning
128-
- tests
129-
uses: l3montree-dev/devguard-action/.github/workflows/sign.yml@main
130-
permissions:
131-
contents: read
132-
packages: write
133-
with:
134-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
135-
api-url: https://api.main.devguard.org
136-
artifact-name: "pkg:oci/scanner?repository_url=ghcr.io/l3montree-dev/devguard/scanner"
137-
image-suffix: "scanner"
86+
nix-cache-substituter: https://nix.garage.l3montree.cloud
87+
nix-cache-public-key: nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
88+
nix-cache-s3-bucket: nix
89+
nix-cache-region: garage
13890
secrets:
13991
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
14092

141-
attest-scanner:
142-
needs:
143-
- build-scanner-image
144-
- scanner-container-scanning
145-
- tests
146-
uses: l3montree-dev/devguard-action/.github/workflows/attest.yml@main
93+
scanner-pipeline:
94+
needs: [tests]
95+
uses: l3montree-dev/devguard-action/.github/workflows/full-nix.yml@nix
14796
permissions:
14897
contents: read
14998
packages: write
99+
security-events: write
150100
with:
101+
nix-target-amd64: devguard-scanner-amd64
102+
nix-target-arm64: devguard-scanner-arm64
103+
image-name: ghcr.io/${{ github.repository }}/scanner
104+
artifact-name-suffix: scanner
151105
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
152106
api-url: https://api.main.devguard.org
153-
artifact-name: "pkg:oci/scanner?repository_url=ghcr.io/l3montree-dev/devguard/scanner"
154-
image-suffix: "scanner"
107+
web-ui: https://main.devguard.org
108+
fail-on-cvss: high
109+
fail-on-risk: high
110+
nix-cache-substituter: https://nix.garage.l3montree.cloud
111+
nix-cache-public-key: nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
112+
nix-cache-s3-bucket: nix
113+
nix-cache-region: garage
155114
secrets:
156115
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
157116

‎.github/workflows/mirror-to-gitlab.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Mirror to GitLab
2+
3+
on:
4+
push:
5+
branches: ["**"]
6+
tags: ["**"]
7+
8+
jobs:
9+
mirror:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
steps:
14+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - https://github.com/actions/checkout/releases/tag/v5.0.0
15+
with:
16+
fetch-depth: 0
17+
fetch-tags: true
18+
persist-credentials: false
19+
20+
- name: Mirror to GitLab
21+
continue-on-error: true
22+
run: |
23+
git remote add gitlab "https://oauth2:${GITLAB_TOKEN}@${GITLAB_HOST}/${GITLAB_REPO}.git"
24+
# Avoid --mirror, which also pushes refs/remotes/* that GitLab rejects as hidden refs.
25+
git push --prune gitlab 'refs/heads/*:refs/heads/*'
26+
git push --prune gitlab 'refs/tags/*:refs/tags/*'
27+
env:
28+
GITLAB_TOKEN: ${{ secrets.GITLAB_MIRROR_TOKEN }}
29+
GITLAB_HOST: ${{ vars.GITLAB_HOST }}
30+
GITLAB_REPO: ${{ vars.GITLAB_REPO }}

‎.github/workflows/postgresql.yaml‎

Lines changed: 14 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -2,72 +2,27 @@ name: DevGuard PostgreSQL Workflow
22

33
on:
44
push:
5-
tags:
6-
- '*'
75

8-
permissions:
9-
contents: read
10-
11-
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
126
jobs:
13-
# Docker image build job
14-
build-image:
15-
uses: l3montree-dev/devguard-action/.github/workflows/build-image.yml@main
7+
postgresql-pipeline:
8+
uses: l3montree-dev/devguard-action/.github/workflows/full-nix.yml@nix
169
permissions:
1710
contents: read
1811
packages: write
12+
security-events: write
1913
with:
20-
artifact-name: "postgresql"
21-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-postgresql
22-
api-url: https://api.main.devguard.org
23-
image-suffix: "postgresql"
24-
secrets:
25-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
26-
build-args: "--context=. --dockerfile=Dockerfile.postgresql"
27-
28-
# Image scanning job to detect vulnerabilities in the built Docker image
29-
container-scanning:
30-
uses: l3montree-dev/devguard-action/.github/workflows/container-scanning.yml@main
31-
needs:
32-
- build-image
33-
with:
14+
nix-target-amd64: postgresql-amd64
15+
nix-target-arm64: postgresql-arm64
16+
image-name: ghcr.io/${{ github.repository }}/postgresql
17+
artifact-name-suffix: postgresql
3418
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-postgresql
3519
api-url: https://api.main.devguard.org
36-
artifact-name: "postgresql"
3720
web-ui: https://main.devguard.org
38-
image-suffix: "postgresql"
39-
secrets:
40-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
41-
42-
deploy:
43-
needs:
44-
- build-image
45-
- container-scanning
46-
uses: l3montree-dev/devguard-action/.github/workflows/deploy.yml@main
47-
permissions:
48-
contents: read
49-
packages: write
50-
with:
51-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-postgresql
52-
api-url: https://api.main.devguard.org
53-
image-suffix: "postgresql"
54-
secrets:
55-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
56-
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
57-
58-
sign:
59-
needs:
60-
- build-image
61-
- container-scanning
62-
uses: l3montree-dev/devguard-action/.github/workflows/sign.yml@main
63-
permissions:
64-
contents: read
65-
packages: write
66-
with:
67-
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-postgresql
68-
api-url: https://api.main.devguard.org
69-
artifact-name: "postgresql"
70-
image-suffix: "postgresql"
21+
fail-on-cvss: high
22+
fail-on-risk: high
23+
nix-cache-substituter: https://nix.garage.l3montree.cloud
24+
nix-cache-public-key: nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
25+
nix-cache-s3-bucket: nix
26+
nix-cache-region: garage
7127
secrets:
72-
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
73-
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
28+
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

‎.gitlab-ci.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# SPDX-License-Identifier: AGPL-3.0
2+
# GitLab CI for the devguard repository (mirrored from GitHub).
3+
4+
stages:
5+
- .pre
6+
- test
7+
- build
8+
- oci-image
9+
- attestation
10+
11+
# ── Lint ──────────────────────────────────────────────────────────────────────
12+
13+
lint:
14+
stage: test
15+
image: golang:1.25
16+
before_script:
17+
- curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh
18+
script:
19+
- golangci-lint run --timeout=30m
20+
21+
22+
.common: &common
23+
devguard_asset_name: "$DEVGUARD_ASSET_NAME"
24+
devguard_api_url: "$DEVGUARD_API_URL"
25+
devguard_web_ui: "$DEVGUARD_WEB_UI"
26+
devguard_token: "$DEVGUARD_TOKEN"
27+
nix_cache_substituter: https://nix.garage.l3montree.cloud
28+
nix_cache_public_key: nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
29+
nix_cache_s3_bucket: nix
30+
nix_cache_region: garage
31+
version: nix
32+
33+
34+
include:
35+
# ── api-pipeline ──────────────────────────────────────────────────────────────
36+
- remote: https://gitlab.com/l3montree/devguard/-/raw/nix/templates/build-nix-multiarch.yml
37+
inputs:
38+
<<: *common
39+
nix_target_amd64: "devguard-amd64"
40+
nix_target_arm64: "devguard-arm64"
41+
arm64_runner_tag: "arm"
42+
43+
# ── scanner-pipeline ──────────────────────────────────────────────────────────
44+
- remote: https://gitlab.com/l3montree/devguard/-/raw/nix/templates/build-nix-multiarch.yml
45+
inputs:
46+
<<: *common
47+
image_suffix: "scanner"
48+
nix_target_amd64: "devguard-scanner-amd64"
49+
nix_target_arm64: "devguard-scanner-arm64"
50+
arm64_runner_tag: "arm"
51+
job_suffix: ":scanner"
52+
version: nix
53+
54+
# ── postgresql-pipeline ──────────────────────────────────────────────────────────
55+
- remote: https://gitlab.com/l3montree/devguard/-/raw/nix/templates/build-nix-multiarch.yml
56+
inputs:
57+
<<: *common
58+
image_suffix: "postgresql"
59+
nix_target_amd64: "postgresql-amd64"
60+
nix_target_arm64: "postgresql-arm64"
61+
arm64_runner_tag: "arm"
62+
job_suffix: ":postgresql"
63+
version: nix

‎.vscode/settings.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
"montree",
1717
"nolint",
1818
"packageurl",
19+
"Pkgs",
1920
"pypi",
2021
"sarif",
2122
"Vulns"

‎Dockerfile‎

Lines changed: 0 additions & 43 deletions
This file was deleted.

0 commit comments

Comments
 (0)