v1.0

.gitignore

@@ -0,0 +1 @@
+.DS_Store

LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 Oversecured Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,80 @@
+Oversecured Action for GitHub
+============================
+
+This GitHub Action enables you to automatically upload your app versions to Oversecured for security scanning. An action user must have an [active Integration](https://oversecured.com/integrations).
+
+### Inputs
+
+- `access_token`: Required. Your Oversecured API key
+- `integration_id`: Required. The integration ID from Oversecured
+- `branch_name`: Optional. The branch name, `main` is default
+- `app_path`: Required. The path to the app file you wish to upload
+
+### Usage
+
+1. Store your Oversecured API key as a secret in your GitHub repository. Navigate to your GitHub repository, go to the `Settings` tab, select `Secrets` from the left sidebar, and click the `New repository secret` button. Name the secret `OVERSECURED_API_KEY` and paste your key.
+2. Add the Oversecured job to your GitHub Actions workflow.
+
+Android example:
+```yml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Change wrapper permissions
+        run: chmod +x ./gradlew
+
+      - name: Build gradle project
+        run: ./gradlew build
+
+      - name: Build debug apk
+        run: ./gradlew assembleDebug
+
+      - name: Oversecured Scanner
+        uses: oversecured/oversecured-github@v1
+        with:
+          access_token: ${{ secrets.OVERSECURED_API_KEY }}
+          integration_id: ${{ vars.OVERSECURED_INTEGRATION_ID }}
+          branch_name: ${{ vars.OVERSECURED_BRANCH_NAME }}
+          app_path: ./app/build/outputs/apk/debug/app-debug.apk
+```
+
+iOS example:
+```yml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Pods Install
+        run: |
+          pod install
+
+      - name: Zip Sources
+        run: |
+          zip -q -r OversecuredZipped.zip .
+
+      - name: Oversecured Scanner
+        uses: oversecured/oversecured-github@v1
+        with:
+          access_token: ${{ secrets.OVERSECURED_API_KEY }}
+          integration_id: ${{ vars.OVERSECURED_INTEGRATION_ID }}
+          branch_name: ${{ vars.OVERSECURED_BRANCH_NAME }}
+          app_path: OversecuredZipped.zip
+```
+
+
+Have Question or Feedback?
+--------------------------
+
+Submit a request using the [contact form](https://support.oversecured.com/hc/en-us/requests/new).
+
+
+### License
+
+The scripts and documentation in this project are released under the [MIT License](https://github.com/oversecured/oversecured-github/blob/main/LICENSE).

action.yml

@@ -0,0 +1,23 @@
+name: 'oversecured-github'
+description: 'Enterprise vulnerability scanner for Android and iOS apps'
+inputs:
+  access_token:
+    description: |
+        A key should be generated in your [profile settings](https://oversecured.com/settings/api-keys).
+    required: true
+  integration_id:
+    description: |
+        Integration ID, automatically generated when the Integration is created.
+    required: true
+  branch_name:
+    description: |
+        Branch name, `main` is default. You can create your own branches in the Integration settings.
+    required: false
+    default: 'main'
+  app_path:
+    description: |
+        The application file for scanning. Oversecured accepts APK/AAB files for Android and zipped sources for iOS.
+    required: true
+runs:
+  using: 'node20'
+  main: 'index.js'

index.js

@@ -0,0 +1,86 @@
+const core = require('@actions/core');
+const axios = require('axios');
+const fs = require('fs');
+core.info(`> Starting to upload the app to Oversecured...`)
+
+async function run() {
+    try {
+        const API_KEY = core.getInput('access_token');
+        const INTEGRATION_ID = core.getInput('integration_id');
+        const BRANCH_NAME = core.getInput('branch_name') || 'main';
+        const appPath = core.getInput('app_path');
+
+        core.info(`App path: ${appPath}`)
+        core.info(`Integration ID: ${INTEGRATION_ID}`)
+        core.info(`Branch name: ${BRANCH_NAME}`)
+
+        const BASE_URL = 'https://api.oversecured.com/v1';
+        const ADD_VERSION = `${BASE_URL}/integrations/${INTEGRATION_ID}/branches/${BRANCH_NAME}/versions/add`;
+        const GET_SIGNED_LINK = `${BASE_URL}/upload/app`;
+
+        const apiSession = axios.create({
+            baseURL: BASE_URL,
+            headers: {'Authorization': API_KEY}
+        });
+
+        const fileName = appPath.split('/').pop();
+        const platform = getPlatform(fileName);
+
+        const signReq = {
+            'file_name': fileName,
+            'platform': platform
+        };
+        core.info('Requesting a signed url...')
+        const getUrlResponse = await apiSession.post(GET_SIGNED_LINK, signReq);
+        if (getUrlResponse.status !== 200) {
+            throw new Error(`Failed to get a signed url: ${getUrlResponse.data}`);
+        }
+        const signInfo = getUrlResponse.data;
+        core.info('Reading app file...')
+        let fileData
+        try {
+            fileData = fs.readFileSync(appPath);
+        } catch (error) {
+            throw new Error(`Failed to read the file: ${error.message}`);
+        }
+        core.info(`Uploading the file to Oversecured...`)
+        let putFileResponse
+        try {
+            putFileResponse = await axios.put(signInfo['url'], fileData);
+        } catch (error) {
+            throw new Error(`Failed to upload file: ${error.message}`);
+        }
+        if (putFileResponse.status !== 200) {
+            throw new Error(`Wrong response code: ${putFileResponse.status}`);
+        }
+
+        core.info(`Creating a new version...`)
+        const addVersionReq = {
+            'file_name': fileName,
+            'bucket_key': signInfo['bucket_key']
+        };
+
+        let addVersionResponse = await apiSession.post(ADD_VERSION, addVersionReq);
+        if (addVersionResponse.status !== 200) {
+            throw new Error(`Failed to add version: ${addVersionResponse.data}`);
+        }
+
+        core.info('> App uploaded successfully!')
+
+    } catch (error) {
+        core.setFailed(error.message);
+    }
+}
+
+function getPlatform(fileName) {
+    fileName = fileName.toLowerCase();
+    if (fileName.endsWith('.apk') || fileName.endsWith('.aab')) {
+        return 'android';
+    }
+    if (fileName.endsWith('.zip')) {
+        return 'ios';
+    }
+    throw new Error(`App file ${fileName} has invalid extension. Only .apk, .aab, and .zip are allowed.`);
+}
+
+run();