From c522e78bd0d2a256acafda7ddc69e2db8f990873 Mon Sep 17 00:00:00 2001 From: Abhilash Reddy Date: Tue, 4 Jun 2024 13:39:12 -0400 Subject: [PATCH] Add workflows --- .github/workflows/codeql.yml | 61 ++++--------- .github/workflows/snyk-zap.yaml | 157 ++++++++++++++++++++++++++++++++ 2 files changed, 173 insertions(+), 45 deletions(-) create mode 100644 .github/workflows/snyk-zap.yaml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9a9d774..9b720bc 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,33 +1,16 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL" +name: "CodeQL-Advanced" on: push: - branches: [ "master", "development" ] + branches: [ "master" ] pull_request: - branches: [ "master", "development" ] - schedule: - - cron: '15 18 * * 5' + branches: [ "master" ] jobs: analyze: name: Analyze (${{ matrix.language }}) - # Runner size impacts CodeQL analysis time. To learn more, please see: - # - https://gh.io/recommended-hardware-resources-for-running-codeql - # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for possible analysis time improvements. - runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + runs-on: + group: ncats-awsci-runners timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} permissions: # required for all workflows @@ -44,18 +27,8 @@ jobs: fail-fast: false matrix: include: - - language: javascript-typescript - build-mode: none - language: python build-mode: none - # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' - # Use `c-cpp` to analyze code written in C, C++ or both - # Use 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, - # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how - # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository uses: actions/checkout@v4 @@ -66,19 +39,6 @@ jobs: with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - # If the analyze step fails for one of the languages you are analyzing with - # "We were unable to automatically build your code", modify the matrix above - # to set the build mode to "manual" for that language. Then modify this step - # to build your code. - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - if: matrix.build-mode == 'manual' shell: bash run: | @@ -93,3 +53,14 @@ jobs: uses: github/codeql-action/analyze@v3 with: category: "/language:${{matrix.language}}" + + - name: Generate Security Report + uses: rsdmike/github-security-report-action@v3.0.4 + with: + token: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload Artifacts + uses: actions/upload-artifact@v4 + with: + name: reports + path: ./*.pdf \ No newline at end of file diff --git a/.github/workflows/snyk-zap.yaml b/.github/workflows/snyk-zap.yaml new file mode 100644 index 0000000..bcb1be1 --- /dev/null +++ b/.github/workflows/snyk-zap.yaml @@ -0,0 +1,157 @@ +# Define the name of the workflow +name: snyk-zap + +# Define variables +env: + DOCKER_REGISTRY: registry.ncats.nih.gov:5000 + IMAGE_NAME: adme + +# Define when the workflow should be triggered (on push to a specific branch and pull requests to the master branch) +on: + push: + branches: [ "master" ] + pull_request: + branches: [ "master" ] + workflow_dispatch: + +# Define the jobs that will be executed as part of the workflow +jobs: + # Job to build and push the ZAP Docker image to Docker Hub + Snyk-Docker-Image: + runs-on: + group: ncats-onprem-internal-runners + permissions: + actions: read + contents: read + security-events: write + issues: write + + outputs: + build_version: ${{ steps.get_build_version.outputs.build_version }} + RUNNER: ${{ runner.name }} + + steps: + # Step 1: Checkout repository + - name: Checkout code + uses: actions/checkout@v4 + + # Step 2: Generate Build Version Number + - name: Generate Build Version Number + id: GET_BUILD_VERSION + run: | + # Get the last recorded date from the environment variable + LAST_DATE=$(date -d "$LAST_BUILD_DATE" +'%Y-%m-%d' 2>/dev/null || echo "") + + # Get the current date + CURRENT_DATE=$(date +'%Y-%m-%d') + echo "Last recorded date: $LAST_DATE" + echo "Current date: $CURRENT_DATE" + + # Check if it's a new day + if [ "$LAST_DATE" != "$CURRENT_DATE" ]; then + # Reset BUILDS_TODAY to 0 for the new day + BUILDS_TODAY=0 + echo "Resetting BUILDS_TODAY to 0 for the new day" + else + # Calculate the number of builds today + BUILDS_TODAY=$(seq -f v$GITHUB_RUN_NUMBER.%g $(($GITHUB_RUN_NUMBER - 1)) | wc -l) + echo "Incrementing BUILDS_TODAY" + fi + + # Store the current date for the next run + echo "LAST_BUILD_DATE=$CURRENT_DATE" >> $GITHUB_ENV + + # Generate the build version with the number of builds today + BUILD_VERSION_GENERATED=$(date +v%Y.%m%d.$BUILDS_TODAY) + echo "Generated Build Version: $BUILD_VERSION_GENERATED" + echo "BUILD_VERSION=$BUILD_VERSION_GENERATED" >> $GITHUB_ENV + echo "BUILD=true" >> $GITHUB_ENV + echo "::set-output name=build_version::$BUILD_VERSION_GENERATED" + + # Step 4: Build a Docker image + - name: Build a Docker image + run: docker build --no-cache -f ./Dockerfile --build-arg BUILD_VERSION=$BUILD_VERSION -t $DOCKER_REGISTRY/$IMAGE_NAME:$BUILD_VERSION . + + # Step 5: Run Snyk to check Docker image for vulnerabilities + - name: Run Snyk to check Docker image for vulnerabilities + continue-on-error: true + uses: snyk/actions/docker@master + id: docker-image-scan + env: + SNYK_TOKEN: ${{ secrets.SNYK_CLI }} + with: + image: $DOCKER_REGISTRY/$IMAGE_NAME:$BUILD_VERSION + args: --sarif-file-output=snyk.sarif --file=Dockerfile + + - name: Replace security-severity undefined for license-related findings + run: | + sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif + sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif + + # Step 6: Upload result to GitHub Code Scanning + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: snyk.sarif + + # Step 7: Generate Security Report + - name: Generate Security Report + continue-on-error: true + uses: rsdmike/github-security-report-action@v3.0.4 + with: + token: ${{ secrets.GITHUB_TOKEN }} + sarifReportDir: . + + # Step 8: Uploads artifacts (PDF reports) generated during the workflow to download. + - name: Upload Artifacts + continue-on-error: true + uses: actions/upload-artifact@v4 + with: + name: reports + path: ./*.pdf + + ZAP-Docker-Scan: + needs: Snyk-Docker-Image + runs-on: ${{needs.Snyk-Docker-Image.outputs.RUNNER}} + permissions: + actions: read + contents: read + security-events: write + issues: write + + steps: + # Step 1: Get BUILD_VERSION from Snyk-Docker-Image job + - name: Get BUILD_VERSION from Snyk-Docker-Image job + id: get_runner_ip + run: | + echo "BUILD_VERSION=${{ needs.Snyk-Docker-Image.outputs.build_version }}" >> $GITHUB_ENV + echo "::set-output name=runner_ip::$(hostname -I | cut -d' ' -f1)" + + # Step 2: Add the command to start Docker image on port 8000 + - name: Start Docker image on port 8000 + continue-on-error: true + run: docker run -d -p 8000:8000 $DOCKER_REGISTRY/$IMAGE_NAME:${{ needs.Snyk-Docker-Image.outputs.build_version }} + + # Step 3: ZAP BASELINE SCAN + - name: ZAP base Scan + continue-on-error: true + uses: zaproxy/action-baseline@v0.12.0 + with: + target: 'http://${{ steps.get_runner_ip.outputs.runner_ip }}:8000' # ip address of the runner + docker_name: 'ghcr.io/zaproxy/zaproxy:stable' + token: ${{ secrets.GITHUB_TOKEN }} + fail_action: false + + # Step 4: Stop and remove the Docker container + - name: Stop and remove Docker container + run: docker stop $(docker ps -q --filter ancestor=$DOCKER_REGISTRY/$IMAGE_NAME:$BUILD_VERSION) && docker rm $(docker ps -a -q --filter ancestor=$DOCKER_REGISTRY/$IMAGE_NAME:$BUILD_VERSION) || true + + # Step 5: Create SARIF file from ZAP results + - name: Create SARIF file from ZAP results + uses: SvanBoxel/zaproxy-to-ghas@main + + # Step 6: Upload SARIF file to GitHub Code Scanning + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif \ No newline at end of file