Skip to content

Commit 9cbd6ab

Browse files
thomaswoehlkethomaswoehlke
committed
Merge remote-tracking branch 'origin/master'
2 parents fc33a25 + e3e7ef6 commit 9cbd6ab

File tree

4 files changed

+285
-0
lines changed

4 files changed

+285
-0
lines changed

‎.github/workflows/codacy-analysis.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# This workflow checks out code, performs a Codacy security scan
2+
# and integrates the results with the
3+
# GitHub Advanced Security code scanning feature. For more information on
4+
# the Codacy security scan action usage and parameters, see
5+
# https://github.com/codacy/codacy-analysis-cli-action.
6+
# For more information on Codacy Analysis CLI in general, see
7+
# https://github.com/codacy/codacy-analysis-cli.
8+
9+
name: Codacy Security Scan
10+
11+
on:
12+
push:
13+
branches: [ "master", "main" ]
14+
pull_request:
15+
branches: [ "master", "main" ]
16+
17+
jobs:
18+
codacy-security-scan:
19+
name: Codacy Security Scan
20+
runs-on: ubuntu-latest
21+
steps:
22+
# Checkout the repository to the GitHub Actions runner
23+
- name: Checkout code
24+
uses: actions/checkout@v2
25+
26+
# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
27+
- name: Run Codacy Analysis CLI
28+
uses: codacy/codacy-analysis-cli-action@1.0.0
29+
with:
30+
# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
31+
# You can also omit the token and run the tools that support default configurations
32+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
33+
verbose: true
34+
output: results.sarif
35+
format: sarif
36+
# Force 0 exit code to allow SARIF file generation
37+
# This will handover control about PR rejection to the GitHub side
38+
max-allowed-issues: 2147483647
39+
40+
# Upload the SARIF file generated in the previous step
41+
- name: Upload SARIF results file
42+
uses: github/codeql-action/upload-sarif@v1
43+
with:
44+
sarif_file: results.sarif

‎.github/workflows/fortify-analysis.yml

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
################################################################################################################################################
2+
# Fortify lets you build secure software fast with an appsec platform that automates testing throughout the DevSecOps pipeline. Fortify static,#
3+
# dynamic, interactive, and runtime security testing is available on premises or as a service. To learn more about Fortify, start a free trial #
4+
# or contact our sales team, visit microfocus.com/appsecurity. #
5+
# #
6+
# Use this workflow template as a basis for integrating Fortify on Demand Static Application Security Testing(SAST) into your GitHub workflows.#
7+
# This template demonstrates the steps to prepare the code+dependencies, initiate a scan, download results once complete and import into #
8+
# GitHub Security Code Scanning Alerts. Existing customers should review inputs and environment variables below to configure scanning against #
9+
# an existing application in your Fortify on Demand tenant. Additional information is available in the comments throughout the workflow, the #
10+
# documentation for the Fortify actions used, and the Fortify on Demand / ScanCentral Client product documentation. If you need additional #
11+
# assistance with configuration, feel free to create a help ticket in the Fortify on Demand portal. #
12+
################################################################################################################################################
13+
14+
name: Fortify on Demand Scan
15+
16+
# TODO: Customize trigger events based on your DevSecOps processes and typical FoD SAST scan time
17+
on:
18+
workflow_dispatch:
19+
push:
20+
branches: [master]
21+
pull_request:
22+
# The branches below must be a subset of the branches above
23+
branches: [master]
24+
25+
jobs:
26+
FoD-SAST-Scan:
27+
# Use the appropriate runner for building your source code.
28+
# TODO: Use a Windows runner for .NET projects that use msbuild. Additional changes to RUN commands will be required to switch to Windows syntax.
29+
runs-on: ubuntu-latest
30+
31+
steps:
32+
# Check out source code
33+
- name: Check Out Source Code
34+
uses: actions/checkout@v2
35+
with:
36+
# Fetch at least the immediate parents so that if this is a pull request then we can checkout the head.
37+
fetch-depth: 2
38+
# If this run was triggered by a pull request event, then checkout the head of the pull request instead of the merge commit.
39+
- run: git checkout HEAD^2
40+
if: ${{ github.event_name == 'pull_request' }}
41+
# Java 8 required by ScanCentral Client and FoD Uploader(Univeral CI Tool)
42+
- name: Setup Java
43+
uses: actions/setup-java@v1
44+
with:
45+
java-version: 1.8
46+
47+
# Prepare source+dependencies for upload. The default example is for a Maven project that uses pom.xml.
48+
# TODO: Update PACKAGE_OPTS based on the ScanCentral Client documentation for your project's included tech stack(s). Helpful hints:
49+
# ScanCentral Client will download dependencies for maven (-bt mvn) and gradle (-bt gradle).
50+
# ScanCentral Client can download dependencies for msbuild projects (-bt msbuild); however, you must convert the workflow to use a Windows runner.
51+
# ScanCentral has additional options that should be set for PHP and Python projects
52+
# For other build tools, add your build commands to download necessary dependencies and prepare according to Fortify on Demand Packaging documentation.
53+
# ScanCentral Client documentation is located at https://www.microfocus.com/documentation/fortify-software-security-center/
54+
- name: Download Fortify ScanCentral Client
55+
uses: fortify/gha-setup-scancentral-client@v1
56+
- name: Package Code + Dependencies
57+
run: scancentral package $PACKAGE_OPTS -o package.zip
58+
env:
59+
PACKAGE_OPTS: "-bt mvn"
60+
61+
# Start Fortify on Demand SAST scan and wait until results complete. For more information on FoDUploader commands, see https://github.com/fod-dev/fod-uploader-java
62+
# TODO: Update ENV variables for your application and create the necessary GitHub Secrets. Helpful hints:
63+
# Credentials and release ID should be obtained from your FoD tenant (either Personal Access Token or API Key can be used).
64+
# Automated Audit preference should be configured for the release's Static Scan Settings in the Fortify on Demand portal.
65+
- name: Download Fortify on Demand Universal CI Tool
66+
uses: fortify/gha-setup-fod-uploader@v1
67+
- name: Perform SAST Scan
68+
run: java -jar $FOD_UPLOAD_JAR -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid "$FOD_RELEASE_ID" -tc "$FOD_TENANT" -uc "$FOD_USER" "$FOD_PAT" $FOD_UPLOADER_OPTS -n "$FOD_UPLOADER_NOTES"
69+
env:
70+
FOD_TENANT: ${{ secrets.FOD_TENANT }}
71+
FOD_USER: ${{ secrets.FOD_USER }}
72+
FOD_PAT: ${{ secrets.FOD_PAT }}
73+
FOD_RELEASE_ID: ${{ secrets.FOD_RELEASE_ID }}
74+
FOD_URL: "https://ams.fortify.com/"
75+
FOD_API_URL: "https://api.ams.fortify.com/"
76+
FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf"
77+
FOD_UPLOADER_NOTES: 'Triggered by GitHub Actions (${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})'
78+
79+
# Once scan completes, pull SAST issues from Fortify on Demand and generate SARIF output.
80+
# TODO: Review Action inputs. For most users, these will be the same as used in the Perform SAST Scan step.
81+
- name: Download Results
82+
uses: fortify/gha-fod-generate-sarif@1.1.0
83+
with:
84+
base-url: https://ams.fortify.com
85+
tenant: ${{ secrets.FOD_TENANT }}
86+
user: ${{ secrets.FOD_USER }}
87+
password: ${{ secrets.FOD_PAT }}
88+
release-id: ${{ secrets.FOD_RELEASE_ID }}
89+
output: ./sarif/output.sarif
90+
91+
# Import Fortify on Demand results to GitHub Security Code Scanning
92+
- name: Import Results
93+
uses: github/codeql-action/upload-sarif@v1
94+
with:
95+
sarif_file: ./sarif/output.sarif

‎.github/workflows/veracode-analysis.yml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert
2+
3+
name: Veracode Static Analysis Pipeline Scan
4+
5+
# Controls when the action will run. Triggers the workflow on push or pull request
6+
# events but only for the master branch
7+
on:
8+
push:
9+
branches: [ master ]
10+
pull_request:
11+
branches: [ master ]
12+
13+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
14+
jobs:
15+
# This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
16+
build-and-pipeline-scan:
17+
# The type of runner that the job will run on
18+
runs-on: ubuntu-latest
19+
steps:
20+
21+
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
22+
- uses: actions/checkout@v2
23+
with:
24+
repository: ''
25+
26+
- uses: papeloto/action-zip@v1
27+
with:
28+
files: /
29+
recursive: true
30+
dest: veracode-pipeline-scan-results-to-sarif.zip
31+
32+
- uses: actions/upload-artifact@v1
33+
with:
34+
name: my-artifact
35+
path: veracode-pipeline-scan-results-to-sarif.zip
36+
37+
# download the Veracode Static Analysis Pipeline scan jar
38+
- uses: wei/curl@master
39+
with:
40+
args: -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
41+
- run: unzip -o pipeline-scan-LATEST.zip
42+
43+
- uses: actions/setup-java@v1
44+
with:
45+
java-version: 1.8
46+
- run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-pipeline-scan-results-to-sarif.zip
47+
continue-on-error: true
48+
- uses: actions/upload-artifact@v1
49+
with:
50+
name: ScanResults
51+
path: results.json
52+
- name: Convert pipeline scan output to SARIF format
53+
id: convert
54+
uses: veracode/veracode-pipeline-scan-results-to-sarif@master
55+
with:
56+
pipeline-results-json: results.json
57+
- uses: github/codeql-action/upload-sarif@v1
58+
with:
59+
# Path to SARIF file relative to the root of the repository
60+
sarif_file: veracode-results.sarif

‎.github/workflows/xanitizer-analysis.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# This workflow downloads and installs the latest version of Xanitizer, builds your project, runs a Xanitizer security analysis on it,
2+
# and then archives the findings list reports and uploads the findings into the GitHub code scanning alert section of your repository.
3+
#
4+
# Documentation for the `RIGS-IT/xanitizer-action` is located here: https://github.com/RIGS-IT/xanitizer-action
5+
#
6+
# To use this basic workflow, you will need to complete the following setup steps:
7+
#
8+
# 1. The underlying Xanitizer, used in this workflow, needs a separate license file.
9+
# Licenses are free of charge for open source projects and for educational usage.
10+
# To get more information about the Xanitizer licenses and how to obtain a license file,
11+
# please consult https://www.xanitizer.com/xanitizer-pricing/.
12+
#
13+
# 2. The content of the license file has to be stored as a GitHub secret (e.g. XANITIZER_LICENSE) on this repository.
14+
# Please consult https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets for details.
15+
#
16+
# 3. Reference the GitHub secret in the step using the `RIGS-IT/xanitizer-action` GitHub action.
17+
# Example:
18+
# - name: Xanitizer Security Analysis
19+
# uses: RIGS-IT/xanitizer-action@v1
20+
# with:
21+
# license: ${{ secrets.XANITIZER_LICENSE }}
22+
#
23+
# 4. As a static application security testing (SAST) tool,
24+
# Xanitizer requires that all dependencies of the artifacts being analyzed can be resolved successfully.
25+
# So you have to install all used libraries and build your project before running the security analysis,
26+
# e.g. via `mvn compile` for Java or `npm install` for JavaScript
27+
28+
name: "Xanitizer Security Analysis"
29+
30+
on:
31+
# Run the workflow on each push
32+
push:
33+
# Run the workflow each day at 5 am
34+
# schedule:
35+
# - cron: '0 5 * * *'
36+
# Run the workflow manually
37+
workflow_dispatch:
38+
39+
jobs:
40+
xanitizer-security-analysis:
41+
# Xanitizer runs on ubuntu-latest and windows-latest.
42+
runs-on: ubuntu-latest
43+
44+
steps:
45+
# Check out the repository
46+
- name: Checkout
47+
uses: actions/checkout@v2
48+
49+
# Set up the correct Java version for your project
50+
# Please comment out, if your project does not contain Java source code.
51+
- name: Set up JDK 13
52+
uses: actions/setup-java@v1
53+
with:
54+
java-version: 13
55+
56+
# Compile the code for Java projects and get all libraries, e.g. via Maven
57+
# Please adapt, if your project uses another build system to compile Java source code.
58+
# Please comment out, if your project does not contain Java source code.
59+
- name: Compile Java code
60+
run: mvn -B compile
61+
62+
# Install all dependent libraries for JavaScript/TypeScript projects, e.g. via npm
63+
# Please adapt to run `npm install` in the correct directories.
64+
# Please adapt, if your project uses another package manager for getting JavaScript libraries.
65+
# Please comment out, if your project does not use a package manager for getting JavaScript libraries.
66+
#- name: Install JavaScript libraries
67+
# run: npm install
68+
69+
# Run the security analysis with default settings
70+
- name: Xanitizer Security Analysis
71+
uses: RIGS-IT/xanitizer-action@v1
72+
with:
73+
license: ${{ secrets.XANITIZER_LICENSE }}
74+
75+
# Archiving the findings list reports
76+
- uses: actions/upload-artifact@v2
77+
with:
78+
name: Xanitizer-Reports
79+
path: |
80+
*-Findings-List.pdf
81+
*-Findings-List.sarif
82+
83+
# Uploads the findings into the GitHub code scanning alert section using the upload-sarif action
84+
- uses: github/codeql-action/upload-sarif@v1
85+
with:
86+
sarif_file: Xanitizer-Findings-List.sarif

0 commit comments

Comments
 (0)