Skip to content

Commit 25a620e

Browse files
epipavepipav
authored
feat: security best practices (#3024)
1 parent 86907aa commit 25a620e

27 files changed

Lines changed: 1174 additions & 1 deletion

‎backend/src/database/migrations/U1744813638__securityInsights.sql‎

Whitespace-only changes.

‎backend/src/database/migrations/V1744813638__securityInsights.sql‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
-- Security Insights Evaluation Suites
2+
create table public."securityInsightsEvaluationSuites" (
3+
"id" uuid not null primary key,
4+
"name" text not null,
5+
"repo" text not null,
6+
"catalogId" text not null,
7+
"result" text not null,
8+
"corruptedState" boolean not null,
9+
"createdAt" timestamp with time zone default now() not null,
10+
"updatedAt" timestamp with time zone default now() not null,
11+
"insightsProjectId" uuid not null,
12+
"insightsProjectSlug" text not null,
13+
14+
foreign key ("insightsProjectId") references "insightsProjects" (id) on delete cascade,
15+
unique ("repo", "catalogId")
16+
);
17+
18+
create index "ix_securityInsightsEvaluationSuites_repo" on "securityInsightsEvaluationSuites"("repo");
19+
create index "ix_securityInsightsEvaluationSuites_updatedAt_id" on "securityInsightsEvaluationSuites" ("updatedAt", id);
20+
21+
-- Security Insights Evaluation Suites Control Evaluations
22+
create table public."securityInsightsEvaluationSuiteControlEvaluations" (
23+
"id" uuid not null primary key,
24+
"securityInsightsEvaluationSuiteId" uuid not null,
25+
"name" text not null,
26+
"repo" text not null,
27+
"controlId" text not null,
28+
"result" text not null,
29+
"message" text not null,
30+
"corruptedState" boolean not null,
31+
"remediationGuide" text not null,
32+
"createdAt" timestamp with time zone default now() not null,
33+
"updatedAt" timestamp with time zone default now() not null,
34+
"insightsProjectId" uuid not null,
35+
"insightsProjectSlug" text not null,
36+
37+
foreign key ("insightsProjectId") references "insightsProjects" (id) on delete cascade,
38+
foreign key ("securityInsightsEvaluationSuiteId") references "securityInsightsEvaluationSuites" (id) on delete cascade,
39+
unique ("securityInsightsEvaluationSuiteId", "repo", "controlId")
40+
);
41+
42+
create index "ix_securityInsightsControlEvaluations_repo" on "securityInsightsEvaluationSuiteControlEvaluations"("repo");
43+
create index "ix_securityInsightsControlEvaluations_updatedAt_id" on "securityInsightsEvaluationSuiteControlEvaluations" ("updatedAt", id);
44+
45+
46+
-- Security Insights Evaluation Suites Control Evaluation Assessments
47+
create table public."securityInsightsEvaluationSuiteControlEvaluationAssessments" (
48+
"id" uuid not null primary key,
49+
"securityInsightsEvaluationSuiteControlEvaluationId" uuid not null,
50+
"repo" text not null,
51+
"requirementId" text not null,
52+
"applicability" text[] not null,
53+
"description" text not null,
54+
"result" text not null,
55+
"message" text not null,
56+
"steps" text[] not null,
57+
"stepsExecuted" integer not null,
58+
"runDuration" text not null,
59+
"createdAt" timestamp with time zone default now() not null,
60+
"updatedAt" timestamp with time zone default now() not null,
61+
"insightsProjectId" uuid not null,
62+
"insightsProjectSlug" text not null,
63+
64+
foreign key ("insightsProjectId") references "insightsProjects" (id) on delete cascade,
65+
foreign key ("securityInsightsEvaluationSuiteControlEvaluationId") references "securityInsightsEvaluationSuiteControlEvaluations" (id) on delete cascade,
66+
unique ("securityInsightsEvaluationSuiteControlEvaluationId", "repo", "requirementId")
67+
);
68+
69+
create index "ix_securityInsightsAssessments_repo" on "securityInsightsEvaluationSuiteControlEvaluationAssessments"("repo");
70+
create index "ix_securityInsightsAssessments_updatedAt_id" on "securityInsightsEvaluationSuiteControlEvaluationAssessments" ("updatedAt", id);
71+
72+
73+
-- Sequin publication migrations
74+
ALTER PUBLICATION sequin_pub ADD TABLE "securityInsightsEvaluationSuiteControlEvaluations";
75+
ALTER PUBLICATION sequin_pub ADD TABLE "securityInsightsEvaluationSuiteControlEvaluationAssessments";
76+
ALTER TABLE public."securityInsightsEvaluationSuiteControlEvaluations" REPLICA IDENTITY FULL;
77+
ALTER TABLE public."securityInsightsEvaluationSuiteControlEvaluationAssessments" REPLICA IDENTITY FULL;

‎pnpm-lock.yaml‎

Lines changed: 55 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎scripts/builders/security-best-practices-worker.env‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
DOCKERFILE="./services/docker/Dockerfile.security_best_practices_worker"
2+
CONTEXT="../"
3+
REPO="sjc.ocir.io/axbydjxa5zuh/security-best-practices-worker"
4+
SERVICES="security-best-practices-worker"

‎scripts/services/docker/Dockerfile.security_best_practices_worker‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
FROM alpine:3.21 AS core
2+
RUN apk add --no-cache wget tar unzip
3+
4+
WORKDIR /app
5+
ARG VERSION=0.7.0
6+
ARG PLATFORM=Linux_x86_64
7+
8+
RUN wget https://github.com/privateerproj/privateer/releases/download/v${VERSION}/privateer_${PLATFORM}.tar.gz
9+
RUN tar -xzf privateer_${PLATFORM}.tar.gz
10+
11+
FROM golang:1.23.4-alpine3.21 AS plugin
12+
RUN apk add --no-cache make git
13+
WORKDIR /plugin
14+
RUN git clone https://github.com/revanite-io/pvtr-github-repo.git
15+
RUN cd pvtr-github-repo && make binary && cp github-repo ../github-repo
16+
17+
FROM node:20-alpine as builder
18+
19+
RUN apk add --no-cache python3 make g++
20+
21+
WORKDIR /usr/crowd/app
22+
RUN npm install -g corepack@latest && corepack enable pnpm && corepack prepare pnpm@9.15.0 --activate
23+
24+
COPY ./pnpm-workspace.yaml ./pnpm-lock.yaml ./
25+
RUN pnpm fetch
26+
27+
COPY ./services ./services
28+
RUN pnpm i --frozen-lockfile
29+
30+
FROM node:20-bookworm-slim as runner
31+
32+
RUN mkdir -p /.privateer/bin
33+
WORKDIR /.privateer/bin
34+
COPY --from=core /app/privateer .
35+
COPY --from=plugin /plugin/github-repo /root/.privateer/bin/github-repo
36+
COPY ./services/apps/security_best_practices_worker/example-config.yml /.privateer/example-config.yml
37+
38+
WORKDIR /usr/crowd/app
39+
RUN npm install -g corepack@latest && corepack enable pnpm && corepack prepare pnpm@9.15.0 --activate && apt update && apt install -y ca-certificates --no-install-recommends && rm -rf /var/lib/apt/lists/*
40+
41+
COPY --from=builder /usr/crowd/app/node_modules ./node_modules
42+
COPY --from=builder /usr/crowd/app/services/base.tsconfig.json ./services/base.tsconfig.json
43+
COPY --from=builder /usr/crowd/app/services/libs ./services/libs
44+
COPY --from=builder /usr/crowd/app/services/archetypes/ ./services/archetypes
45+
COPY --from=builder /usr/crowd/app/services/apps/security_best_practices_worker/ ./services/apps/security_best_practices_worker

‎scripts/services/docker/Dockerfile.security_best_practices_worker.dockerignore‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
**/.git
2+
**/node_modules
3+
**/venv*
4+
**/.webpack
5+
**/.serverless
6+
**/.env
7+
**/.env.*
8+
**/.idea
9+
**/.vscode
10+
**/dist
11+
.vscode/
12+
.github/
13+
frontend/
14+
scripts/
15+
.flake8
16+
*.md
17+
Makefile
18+
backend/

‎scripts/services/security-best-practices-worker.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
version: '3.1'
2+
3+
x-env-args: &env-args
4+
DOCKER_BUILDKIT: 1
5+
NODE_ENV: docker
6+
SERVICE: security-best-practices-worker
7+
CROWD_TEMPORAL_TASKQUEUE: security-best-practices
8+
SHELL: /bin/sh
9+
10+
services:
11+
security-best-practices-worker:
12+
build:
13+
context: ../../
14+
dockerfile: ./scripts/services/docker/Dockerfile.security_best_practices_worker
15+
command: 'pnpm run start'
16+
working_dir: /usr/crowd/app/services/apps/security_best_practices_worker
17+
env_file:
18+
- ../../backend/.env.dist.local
19+
- ../../backend/.env.dist.composed
20+
- ../../backend/.env.override.local
21+
- ../../backend/.env.override.composed
22+
environment:
23+
<<: *env-args
24+
restart: always
25+
networks:
26+
- crowd-bridge
27+
28+
security-best-practices-worker-dev:
29+
build:
30+
context: ../../
31+
dockerfile: ./scripts/services/docker/Dockerfile.security_best_practices_worker
32+
command: 'pnpm run dev'
33+
working_dir: /usr/crowd/app/services/apps/security_best_practices_worker
34+
# user: '${USER_ID}:${GROUP_ID}'
35+
env_file:
36+
- ../../backend/.env.dist.local
37+
- ../../backend/.env.dist.composed
38+
- ../../backend/.env.override.local
39+
- ../../backend/.env.override.composed
40+
environment:
41+
<<: *env-args
42+
hostname: security-best-practices-worker
43+
networks:
44+
- crowd-bridge
45+
volumes:
46+
- ../../services/libs/audit-logs/src:/usr/crowd/app/services/libs/audit-logs/src
47+
- ../../services/libs/common/src:/usr/crowd/app/services/libs/common/src
48+
- ../../services/libs/common_services/src:/usr/crowd/app/services/libs/common_services/src
49+
- ../../services/libs/data-access-layer/src:/usr/crowd/app/services/libs/data-access-layer/src
50+
- ../../services/libs/database/src:/usr/crowd/app/services/libs/database/src
51+
- ../../services/libs/integrations/src:/usr/crowd/app/services/libs/integrations/src
52+
- ../../services/libs/logging/src:/usr/crowd/app/services/libs/logging/src
53+
- ../../services/libs/opensearch/src:/usr/crowd/app/services/libs/opensearch/src
54+
- ../../services/libs/questdb/src:/usr/crowd/app/services/libs/questdb/src
55+
- ../../services/libs/queue/src:/usr/crowd/app/services/libs/queue/src
56+
- ../../services/libs/redis/src:/usr/crowd/app/services/libs/redis/src
57+
- ../../services/libs/telemetry/src:/usr/crowd/app/services/libs/telemetry/src
58+
- ../../services/libs/temporal/src:/usr/crowd/app/services/libs/temporal/src
59+
- ../../services/libs/types/src:/usr/crowd/app/services/libs/types/src
60+
- ../../services/apps/security_best_practices_worker/src:/usr/crowd/app/services/apps/security_best_practices_worker/src
61+
62+
networks:
63+
crowd-bridge:
64+
external: true

‎services/apps/security_best_practices_worker/example-config.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
loglevel: info
2+
write-directory: evaluation_results
3+
write: true
4+
services:
5+
$REPO_NAME:
6+
plugin: github-repo
7+
8+
policy:
9+
catalogs:
10+
- OSPS_B
11+
applicability:
12+
- Maturity Level 1
13+
14+
vars:
15+
owner: $REPO_OWNER
16+
repo: $REPO_NAME
17+
token: $GITHUB_TOKEN

‎services/apps/security_best_practices_worker/package.json‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
{
2+
"name": "@crowd/security-best-practices-worker",
3+
"scripts": {
4+
"start": "CROWD_TEMPORAL_TASKQUEUE=security-best-practices SERVICE=security-best-practices-worker tsx src/main.ts",
5+
"start:debug:local": "set -a && . ../../../backend/.env.dist.local && . ../../../backend/.env.override.local && set +a && CROWD_TEMPORAL_TASKQUEUE=security-best-practices SERVICE=security-best-practices-worker LOG_LEVEL=trace tsx --inspect=0.0.0.0:9232 src/main.ts",
6+
"start:debug": "CROWD_TEMPORAL_TASKQUEUE=security-best-practices SERVICE=security-best-practices-worker LOG_LEVEL=info tsx --inspect=0.0.0.0:9232 src/main.ts",
7+
"dev:local": "nodemon --watch src --watch ../../libs --ext ts --exec pnpm run start:debug:local",
8+
"dev": "nodemon --watch src --watch ../../libs --ext ts --exec pnpm run start:debug",
9+
"lint": "npx eslint --ext .ts src --max-warnings=0",
10+
"format": "npx prettier --write \"src/**/*.ts\"",
11+
"format-check": "npx prettier --check .",
12+
"tsc-check": "tsc --noEmit"
13+
},
14+
"dependencies": {
15+
"@crowd/archetype-standard": "workspace:*",
16+
"@crowd/archetype-worker": "workspace:*",
17+
"@crowd/data-access-layer": "workspace:*",
18+
"@crowd/logging": "workspace:*",
19+
"@crowd/common": "workspace:*",
20+
"@crowd/opensearch": "workspace:*",
21+
"@crowd/redis": "workspace:*",
22+
"@crowd/types": "workspace:*",
23+
"@temporalio/workflow": "~1.11.1",
24+
"@temporalio/client": "~1.11.1",
25+
"axios": "^1.6.8",
26+
"moment": "~2.29.4",
27+
"tsx": "^4.7.1",
28+
"typescript": "^5.6.3",
29+
"js-yaml": "^4.1.0"
30+
},
31+
"devDependencies": {
32+
"@types/node": "^20.8.2",
33+
"nodemon": "^3.0.1"
34+
}
35+
}

‎services/apps/security_best_practices_worker/src/activities.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
import {
2+
findObsoleteRepos,
3+
getOSPSBaselineInsights,
4+
saveOSPSBaselineInsightsToDB,
5+
} from './activities/index'
6+
7+
export { getOSPSBaselineInsights, saveOSPSBaselineInsightsToDB, findObsoleteRepos }

0 commit comments

Comments
 (0)