Skip to content

Commit df68a7f

Browse files
RkarekoRkareko
authored
Merge pull request #1192 from opensrp/security-ci-scan
Scanning CI
2 parents a606c2b + 88cc6be commit df68a7f

File tree

13 files changed

+506
-11
lines changed

13 files changed

+506
-11
lines changed

‎.github/codeql/codeql-config.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: My CodeQL Analysis
2+
description: A sample CodeQL analysis
3+
4+
paths:
5+
- src
6+
# Ignore the "docs" and "src/test" directories
7+
paths-ignore:
8+
- 'docs/**'
9+
- 'src/test/**'
10+
11+
# # Specify the CodeQL queries to run
12+
# queries:
13+
# - my-query.ql

‎.github/dependabot.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
version: 2
2+
updates:
3+
# Keep maven dependencies up-to-date
4+
- package-ecosystem: maven
5+
# Look for `pom.xml` in the `root` directory
6+
directory: "/"
7+
# Check the maven registry for updates every day (weekdays)
8+
schedule:
9+
interval: daily
10+
open-pull-requests-limit: 10
11+
target-branch:
12+
- "master"
13+
- "v2"
14+
# Raise all maven pull requests with custom labels
15+
labels:
16+
- "maven dependencies"
17+
commit-message:
18+
prefix: requirements
19+
reviewers:
20+
- "hilpitome"
21+
- "ekigamba"
22+
23+
24+
# Keep docker dependencies up-to-date
25+
- package-ecosystem: docker
26+
# Look for `Dockerfile` in the `root` directory
27+
directory: "/"
28+
# Check the docker registry for updates every day (weekdays)
29+
schedule:
30+
interval: daily
31+
open-pull-requests-limit: 10
32+
target-branch:
33+
- "master"
34+
- "v2"
35+
# Raise all docker pull requests with custom labels
36+
labels:
37+
- "docker dependencies"
38+
commit-message:
39+
prefix: requirements
40+
reviewers:
41+
- "ukanga"
42+
- "bennsimon"
43+
- "qiarie"
44+
- "manutarus"
45+
- "hilpitome"
46+
- "ekigamba"
47+
- "ndegwamartin"

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
2+
name: "CodeQL Repository scan"
3+
4+
on:
5+
push:
6+
branches:
7+
# - master
8+
# - v2*
9+
- security-ci-scan
10+
11+
# Publish `v1.2.3` tags as releases.
12+
tags:
13+
- v*
14+
pull_request:
15+
schedule:
16+
- cron: '0 3 * * 1,3' # CodeQL Scan every Monday and Wednesday at 3 AM UTC
17+
# wokflow_dispatch option enables for manual scanning
18+
workflow_dispatch:
19+
20+
21+
jobs:
22+
analyze:
23+
name: Analyze
24+
runs-on: ubuntu-latest
25+
permissions:
26+
actions: read
27+
contents: read
28+
security-events: write
29+
30+
strategy:
31+
fail-fast: false
32+
matrix:
33+
language: [ 'java' ]
34+
35+
36+
steps:
37+
- name: Cancel previous workflow runs
38+
uses: styfle/[email protected]
39+
with:
40+
access_token: ${{ github.token }}
41+
42+
- name: Checkout repository
43+
uses: actions/checkout@v3
44+
with:
45+
submodules: recursive
46+
47+
- name: Set up JDK 11
48+
uses: actions/setup-java@v1
49+
with:
50+
java-version: 11
51+
52+
# Initializes the CodeQL tools for scanning.
53+
- name: Initialize CodeQL
54+
uses: github/codeql-action/init@v2
55+
with:
56+
languages: ${{ matrix.language }}
57+
queries: security-and-quality
58+
config-file: './.github/codeql/codeql-config.yml'
59+
# If you wish to specify custom queries, you can do so here or in a config file.
60+
# By default, queries listed here will override any specified in a config file.
61+
# Prefix the list here with "+" to use these queries and those in the config file.
62+
63+
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
64+
# queries: security-extended,security-and-quality
65+
66+
67+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
68+
- name: Autobuild Java Code
69+
run: |
70+
mvn clean install -DskipTests
71+
72+
# ℹ️ Command-line programs to run using the OS shell.
73+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
74+
75+
# If the Autobuild fails above, remove it and uncomment the following three lines.
76+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
77+
78+
# - run: |
79+
# echo "Run, Build Application using script"
80+
# ./location_of_script_within_repo/buildscript.sh
81+
82+
- name: Perform CodeQL Analysis
83+
uses: github/codeql-action/analyze@v2
84+
id: run-analysis
85+
with:
86+
category: "/language:${{matrix.language}}"
87+
output: 'results'
88+
89+
- name: Upload CodeQL results as an artifact
90+
uses: actions/upload-artifact@v3
91+
with:
92+
# Path to SARIF file relative to the root of the repository
93+
name: "java.sarif"
94+
path: './results/java.sarif'
95+
96+
- name: Import CodeQL Findings to DefectDojo
97+
uses: portswigger-cloud/defectdojo-import-scan@v1
98+
with:
99+
defectdojo-url: ${{ secrets.DEFECTOJO_URL }}
100+
defectdojo-username: ${{ secrets.DEFECTOJO_USERNAME }}
101+
defectdojo-password: ${{ secrets.DEFECTOJO_PASSWORD }}
102+
defectdojo-product-type: OPENSRP
103+
defectdojo-product: OpenSRP-Server-Web
104+
defectdojo-environment-type: Test
105+
defectdojo-scan-type: SARIF
106+
defectdojo-engagement-name: Github Actions Initiated CodeQL Code Scan
107+
scan-results-file-name: './results/java.sarif'
108+
109+

‎.github/workflows/docker-publish.yml‎

Lines changed: 110 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@ on:
77
paths-ignore:
88
- 'docs/**'
99
branches:
10-
- master
10+
# - master
11+
# - v2*
12+
- security-ci-scan #To be deleted
1113

1214
# Publish `v1.2.3` tags as releases.
1315
tags:
@@ -24,6 +26,11 @@ on:
2426
description: "Includes the specified tag to docker image tags"
2527
required: false
2628

29+
# For Trivy Code Scanning
30+
env:
31+
FULL_SUMMARY: ""
32+
PATCH_SUMMARY: ""
33+
2734
jobs:
2835
# Run image build test
2936
test:
@@ -103,3 +110,105 @@ jobs:
103110
104111
- name: Image digest
105112
run: echo ${{ steps.docker_build.outputs.digest }}
113+
114+
- name: Run Trivy vulnerability scanner on Docker image - JSON (Full Scan)
115+
uses: aquasecurity/trivy-action@master
116+
with:
117+
image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
118+
format: json
119+
output: 'trivy-docker-full-results.json'
120+
121+
- name: Create summary of trivy issues on Docker image
122+
run: |
123+
summary=$(jq -r '.Results[] | select(.Vulnerabilities) | .Vulnerabilities | group_by(.Severity) | map({Severity: .[0].Severity, Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-docker-full-results.json | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
124+
if [ -z $summary ]
125+
then
126+
summary="No vulnerabilities found"
127+
fi
128+
echo "FULL_SUMMARY=$summary" >> $GITHUB_ENV
129+
130+
- name: Run Trivy vulnerability scanner on Docker image - JSON (with Patches)
131+
uses: aquasecurity/trivy-action@master
132+
with:
133+
image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
134+
ignore-unfixed: true
135+
format: 'json'
136+
output: 'trivy-docker-fixable-results.json'
137+
138+
- name: Create summary of trivy issues on Docker image
139+
run: |
140+
summary=$(jq -r '.Results[] | select(.Vulnerabilities) | .Vulnerabilities | group_by(.Severity) | map({Severity: .[0].Severity, Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-docker-fixable-results.json | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
141+
if [ -z $summary ]
142+
then
143+
summary="No issues or vulnerability fixes available"
144+
fi
145+
echo "PATCH_SUMMARY=$summary" >> $GITHUB_ENV
146+
147+
- name: Run Trivy vulnerability scanner on Docker image - SARIF
148+
uses: aquasecurity/trivy-action@master
149+
with:
150+
image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
151+
format: sarif
152+
ignore-unfixed: true
153+
output: 'trivy-docker-results.sarif'
154+
155+
- name: Upload Trivy scan results to GitHub Security tab
156+
uses: github/codeql-action/upload-sarif@v2
157+
with:
158+
sarif_file: 'trivy-docker-results.sarif'
159+
160+
- name: Generate trivy HTML report on Docker image for download
161+
uses: aquasecurity/trivy-action@master
162+
with:
163+
image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
164+
format: 'template'
165+
template: '@/contrib/html.tpl'
166+
output: 'trivy-docker-report.html'
167+
168+
- name: Upload Trivy results as an artifact
169+
uses: actions/upload-artifact@v3
170+
with:
171+
name: "trivy-results-opensrp-server-web-docker-report.html"
172+
path: './trivy-docker-report.html'
173+
retention-days: 30
174+
175+
- name: Send Slack Notification
176+
uses: slackapi/[email protected]
177+
with:
178+
payload: |
179+
{
180+
"text": "Trivy scan results for ${{ github.repository }} repository",
181+
"blocks": [
182+
{
183+
"type": "section",
184+
"text": {
185+
"type": "mrkdwn",
186+
"text": "TRIVY DOCKER SCAN RESULTS FOR ${{ github.repository }} REPOSITORY"
187+
}
188+
},
189+
{
190+
"type": "section",
191+
"text": {
192+
"type": "mrkdwn",
193+
"text": " Total Vulnerabilities: ${{ env.FULL_SUMMARY }}"
194+
}
195+
},
196+
{
197+
"type": "section",
198+
"text": {
199+
"type": "mrkdwn",
200+
"text": " Vulnerabilities with fixes: ${{ env.PATCH_SUMMARY }}"
201+
}
202+
},
203+
{
204+
"type": "section",
205+
"text": {
206+
"type": "mrkdwn",
207+
"text": " View HTML result artifact: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}. Artifact is only valid for 30 days."
208+
}
209+
}
210+
]
211+
}
212+
env:
213+
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
214+
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

0 commit comments

Comments
 (0)