From e7b6150c5d5e51b08fd12c97dac956e3a2aff175 Mon Sep 17 00:00:00 2001 From: abdul-hai-apisec Date: Thu, 3 Feb 2022 13:54:14 +0530 Subject: [PATCH 01/11] Added underscore(_) in the name to fix yml errors caused by the empty spaces in the name --- code-scanning/apisec-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/apisec-scan.yml b/code-scanning/apisec-scan.yml index 3aa06ca..65a6baf 100644 --- a/code-scanning/apisec-scan.yml +++ b/code-scanning/apisec-scan.yml @@ -43,7 +43,7 @@ on: jobs: - Trigger APIsec scan: + Trigger_APIsec_scan: runs-on: ubuntu-latest steps: From d14e8af6e3b15be640c45ec39df46968b03267a2 Mon Sep 17 00:00:00 2001 From: abdul-hai-apisec Date: Tue, 30 Aug 2022 21:45:04 +0530 Subject: [PATCH 02/11] Added EthicalCheck Action --- code-scanning/ethicalcheck.yml | 57 +++++++++++++++++++ .../properties/ethicalcheck.properties.json | 24 ++++++++ 2 files changed, 81 insertions(+) create mode 100644 code-scanning/ethicalcheck.yml create mode 100644 code-scanning/properties/ethicalcheck.properties.json diff --git a/code-scanning/ethicalcheck.yml b/code-scanning/ethicalcheck.yml new file mode 100644 index 0000000..c089015 --- /dev/null +++ b/code-scanning/ethicalcheck.yml @@ -0,0 +1,57 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# EthicalCheck addresses the critical need to continuously security test APIs in development and in production. + +# EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list. +# Developers relies on EthicalCheck to evaluate every update and release, ensuring that no APIs go to production with exploitable vulnerabilities. + +# You develop the application and API, we bring complete and continuous security testing to you, accelerating development. + +# Know your API and Applications are secure with EthicalCheck – our free & automated API security testing service. + +# How EthicalCheck works? +# EthicalCheck functions in the following simple steps. +# 1. Security Testing. +# Provide your OpenAPI specification or start with a public Postman collection URL. +# EthicalCheck instantly instrospects your API and creates a map of API endpoints for security testing. +# It then automatically creates hundreds of security tests that are non-intrusive to comprehensively and completely test for authentication, authorizations, and OWASP bugs your API. The tests addresses the OWASP API Security categories including OAuth 2.0, JWT, Rate Limit etc. + +# 2. Reporting. +# EthicalCheck generates security test report that includes all the tested endpoints, coverage graph, exceptions, and vulnerabilities. +# Vulnerabilities are fully triaged, it contains CVSS score, severity, endpoint information, and OWASP tagging. + + +# This is a starter workflow to help you get started with EthicalCheck Actions + +name: EthicalCheck-Workflow + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the $default-branch branch + # Customize trigger events based on your DevSecOps processes. + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + + +jobs: + Trigger_EthicalCheck: + runs-on: ubuntu-latest + + steps: + - name: EthicalCheck Free & Automated API Security Testing Service + uses: apisec-inc/ethicalcheck-action@latest + with: + # The OpenAPI Specification URL or Swagger Path or Public Postman collection URL. + oas-url: "http://netbanking.apisec.ai:8080/v2/api-docs" + # The email address to which the penetration test report will be sent. + email: "xxx@apisec.ai" \ No newline at end of file diff --git a/code-scanning/properties/ethicalcheck.properties.json b/code-scanning/properties/ethicalcheck.properties.json new file mode 100644 index 0000000..c0949be --- /dev/null +++ b/code-scanning/properties/ethicalcheck.properties.json @@ -0,0 +1,24 @@ +{ + "name": "EthicalCheck", + "creator": "APIsec", + "description": "EthicalCheck addresses the critical need to continuously security test APIs in development and in production. EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list. Developers relies on EthicalCheck to evaluate every update and release, ensuring that no APIs go to production with exploitable vulnerabilities. You develop the application and API, we bring complete and continuous security testing to you, accelerating development.Know your API and Applications are secure with EthicalCheck – our free & automated API security testing service.", + "iconName": "apisec", + "categories": [ + "Code Scanning", + "C", + "C#", + "C++", + "Go", + "Java", + "JavaScript", + "Kotlin", + "Objective C", + "PHP", + "Python", + "Ruby", + "Rust", + "Scala", + "Swift", + "TypeScript" + ] +} From 6a3b2bbd2ec26fd76e5e1eca8365eedddf483835 Mon Sep 17 00:00:00 2001 From: Nick McCurdy Date: Thu, 22 Sep 2022 10:46:38 -0400 Subject: [PATCH 03/11] Add pages directory to readme --- README.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index f39892f..9cf6833 100644 --- a/README.md +++ b/README.md @@ -12,10 +12,11 @@ These are the workflow files for helping people get started with GitHub Actions. ### Directory structure -* [ci](ci): solutions for Continuous Integration workflows. -* [deployments](deployments): solutions for Deployment workflows. -* [automation](automation): solutions for automating workflows. -* [code-scanning](code-scanning): starter workflows for [Code Scanning](https://github.com/features/security) +* [ci](ci): solutions for Continuous Integration workflows +* [deployments](deployments): solutions for Deployment workflows +* [automation](automation): solutions for automating workflows +* [code-scanning](code-scanning): solutions for [Code Scanning](https://github.com/features/security) +* [pages](pages): solutions for Pages workflows * [icons](icons): svg icons for the relevant template Each workflow must be written in YAML and have a `.yml` extension. They also need a corresponding `.properties.json` file that contains extra metadata about the workflow (this is displayed in the GitHub.com UI). @@ -40,6 +41,14 @@ For example: `ci/django.yml` and `ci/properties/django.properties.json`. * monitoring * Automation * utilities +* Pages +* Hugo +* Gatsby +* Next +* Nuxt +* HTML +* JavaScript +* CSS ### Variables These variables can be placed in the starter workflow and will be substituted as detailed below: From 3f6632a2aee5450e054cc12323ff30695875d46b Mon Sep 17 00:00:00 2001 From: Nick McCurdy Date: Fri, 23 Sep 2022 11:42:07 -0400 Subject: [PATCH 04/11] Remove redundant languages --- README.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/README.md b/README.md index 9cf6833..fa8d351 100644 --- a/README.md +++ b/README.md @@ -46,9 +46,6 @@ For example: `ci/django.yml` and `ci/properties/django.properties.json`. * Gatsby * Next * Nuxt -* HTML -* JavaScript -* CSS ### Variables These variables can be placed in the starter workflow and will be substituted as detailed below: From 988cccd442c473a2a89d6793baf896c191a10002 Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Mon, 10 Oct 2022 11:12:22 +0000 Subject: [PATCH 05/11] Update old documentation links --- ci/ant.yml | 2 +- ci/dotnet.yml | 3 +++ ci/go.yml | 3 +++ ci/gradle.yml | 2 +- ci/maven.yml | 2 +- ci/node.js.yml | 2 +- ci/npm-publish-github-packages.yml | 2 +- ci/npm-publish.yml | 2 +- ci/python-app.yml | 2 +- ci/python-package.yml | 2 +- ci/python-publish.yml | 2 +- ci/swift.yml | 3 +++ 12 files changed, 18 insertions(+), 9 deletions(-) diff --git a/ci/ant.yml b/ci/ant.yml index 1614664..e9dba01 100644 --- a/ci/ant.yml +++ b/ci/ant.yml @@ -1,5 +1,5 @@ # This workflow will build a Java project with Ant -# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-ant +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-ant name: Java CI diff --git a/ci/dotnet.yml b/ci/dotnet.yml index 7465e23..f11f050 100644 --- a/ci/dotnet.yml +++ b/ci/dotnet.yml @@ -1,3 +1,6 @@ +# This workflow will build a .NET project +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-net + name: .NET on: diff --git a/ci/go.yml b/ci/go.yml index bb3ec96..4d95674 100644 --- a/ci/go.yml +++ b/ci/go.yml @@ -1,3 +1,6 @@ +# This workflow will build a golang project +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go + name: Go on: diff --git a/ci/gradle.yml b/ci/gradle.yml index 0c0f12c..2be0b58 100644 --- a/ci/gradle.yml +++ b/ci/gradle.yml @@ -3,7 +3,7 @@ # separate terms of service, privacy policy, and support # documentation. # This workflow will build a Java project with Gradle and cache/restore any dependencies to improve the workflow execution time -# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-gradle +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-gradle name: Java CI with Gradle diff --git a/ci/maven.yml b/ci/maven.yml index 65e0dff..26bfc73 100644 --- a/ci/maven.yml +++ b/ci/maven.yml @@ -1,5 +1,5 @@ # This workflow will build a Java project with Maven, and cache/restore any dependencies to improve the workflow execution time -# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-java-with-maven name: Java CI with Maven diff --git a/ci/node.js.yml b/ci/node.js.yml index a89108d..f230593 100644 --- a/ci/node.js.yml +++ b/ci/node.js.yml @@ -1,5 +1,5 @@ # This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node -# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs name: Node.js CI diff --git a/ci/npm-publish-github-packages.yml b/ci/npm-publish-github-packages.yml index 638ccf8..e790f4d 100644 --- a/ci/npm-publish-github-packages.yml +++ b/ci/npm-publish-github-packages.yml @@ -1,5 +1,5 @@ # This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages +# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages name: Node.js Package diff --git a/ci/npm-publish.yml b/ci/npm-publish.yml index c461c85..6cdebaf 100644 --- a/ci/npm-publish.yml +++ b/ci/npm-publish.yml @@ -1,5 +1,5 @@ # This workflow will run tests using node and then publish a package to GitHub Packages when a release is created -# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages +# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages name: Node.js Package diff --git a/ci/python-app.yml b/ci/python-app.yml index 4b7fa5f..9945382 100644 --- a/ci/python-app.yml +++ b/ci/python-app.yml @@ -1,5 +1,5 @@ # This workflow will install Python dependencies, run tests and lint with a single version of Python -# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python name: Python application diff --git a/ci/python-package.yml b/ci/python-package.yml index 583a366..de579a3 100644 --- a/ci/python-package.yml +++ b/ci/python-package.yml @@ -1,5 +1,5 @@ # This workflow will install Python dependencies, run tests and lint with a variety of Python versions -# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python name: Python package diff --git a/ci/python-publish.yml b/ci/python-publish.yml index ec70354..bdaab28 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -1,5 +1,5 @@ # This workflow will upload a Python Package using Twine when a release is created -# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by diff --git a/ci/swift.yml b/ci/swift.yml index 3668fc0..9d84f86 100644 --- a/ci/swift.yml +++ b/ci/swift.yml @@ -1,3 +1,6 @@ +# This workflow will build a golang project +# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-swift + name: Swift on: From 9a9cef713d58450916333470a1bd233e97c2f83e Mon Sep 17 00:00:00 2001 From: abdul-hai-apisec <83706991+abdul-hai-apisec@users.noreply.github.com> Date: Wed, 12 Oct 2022 14:21:47 +0530 Subject: [PATCH 06/11] Update ethicalcheck.yml --- code-scanning/ethicalcheck.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/code-scanning/ethicalcheck.yml b/code-scanning/ethicalcheck.yml index c089015..4a8ad3c 100644 --- a/code-scanning/ethicalcheck.yml +++ b/code-scanning/ethicalcheck.yml @@ -49,9 +49,16 @@ jobs: steps: - name: EthicalCheck Free & Automated API Security Testing Service - uses: apisec-inc/ethicalcheck-action@latest + uses: apisec-inc/ethicalcheck-action@005fac321dd843682b1af6b72f30caaf9952c641 with: # The OpenAPI Specification URL or Swagger Path or Public Postman collection URL. oas-url: "http://netbanking.apisec.ai:8080/v2/api-docs" # The email address to which the penetration test report will be sent. - email: "xxx@apisec.ai" \ No newline at end of file + email: "xxx@apisec.ai" + sarif-result-file: "ethicalcheck-results.sarif" + + - name: Upload sarif file to repository + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ./ethicalcheck-results.sarif + From 90fcb3f10e2f67fb9e90e866901f7e9173317ea3 Mon Sep 17 00:00:00 2001 From: abdul-hai-apisec Date: Wed, 12 Oct 2022 20:30:11 +0530 Subject: [PATCH 07/11] Added permissions --- code-scanning/ethicalcheck.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/code-scanning/ethicalcheck.yml b/code-scanning/ethicalcheck.yml index 4a8ad3c..2818bc6 100644 --- a/code-scanning/ethicalcheck.yml +++ b/code-scanning/ethicalcheck.yml @@ -42,9 +42,14 @@ on: # Allows you to run this workflow manually from the Actions tab workflow_dispatch: - +permissions: + contents: read + jobs: Trigger_EthicalCheck: + permissions: + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status runs-on: ubuntu-latest steps: @@ -57,8 +62,8 @@ jobs: email: "xxx@apisec.ai" sarif-result-file: "ethicalcheck-results.sarif" - - name: Upload sarif file to repository - uses: github/codeql-action/upload-sarif@v2 - with: + - name: Upload sarif file to repository + uses: github/codeql-action/upload-sarif@v2 + with: sarif_file: ./ethicalcheck-results.sarif From 9c49b9d11c5dd12f3732b4707fde87d4753c3873 Mon Sep 17 00:00:00 2001 From: Nick McCurdy Date: Mon, 17 Oct 2022 08:31:16 -0400 Subject: [PATCH 08/11] Delete Gatsby, Next, and Nuxt categories https://github.com/actions/starter-workflows/pull/1762#discussion_r996963757 --- README.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/README.md b/README.md index fa8d351..7ff406f 100644 --- a/README.md +++ b/README.md @@ -43,9 +43,6 @@ For example: `ci/django.yml` and `ci/properties/django.properties.json`. * utilities * Pages * Hugo -* Gatsby -* Next -* Nuxt ### Variables These variables can be placed in the starter workflow and will be substituted as detailed below: From e5b363612e747c2961857eef5c4d66d2824a1efc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Oct 2022 13:53:14 +0000 Subject: [PATCH 09/11] Bump pozil/auto-assign-issue from 1.10.1 to 1.11.0 Bumps [pozil/auto-assign-issue](https://github.com/pozil/auto-assign-issue) from 1.10.1 to 1.11.0. - [Release notes](https://github.com/pozil/auto-assign-issue/releases) - [Commits](https://github.com/pozil/auto-assign-issue/compare/v1.10.1...v1.11.0) --- updated-dependencies: - dependency-name: pozil/auto-assign-issue dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-assign-issues.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-assign-issues.yml b/.github/workflows/auto-assign-issues.yml index 98f071a..adaa8d6 100644 --- a/.github/workflows/auto-assign-issues.yml +++ b/.github/workflows/auto-assign-issues.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: 'Auto-assign issue' - uses: pozil/auto-assign-issue@v1.10.1 + uses: pozil/auto-assign-issue@v1.11.0 with: assignees: phantsure,tiwarishub,anuragc617,vsvipul,bishal-pdmsft numOfAssignee: 1 From 94ce36310999d6d76d8a1b23bdc1f09f5b38f6fe Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Tue, 18 Oct 2022 18:19:20 +0530 Subject: [PATCH 10/11] Update ci/swift.yml Co-authored-by: Scott Brenner --- ci/swift.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/swift.yml b/ci/swift.yml index 9d84f86..91276e3 100644 --- a/ci/swift.yml +++ b/ci/swift.yml @@ -1,4 +1,4 @@ -# This workflow will build a golang project +# This workflow will build a Swift project # For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-swift name: Swift From 7482e30dc1cfa91d8f20b52fc6416d6dec435652 Mon Sep 17 00:00:00 2001 From: abdul-hai-apisec Date: Thu, 20 Oct 2022 11:11:54 +0530 Subject: [PATCH 11/11] Updated the description --- code-scanning/properties/ethicalcheck.properties.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/properties/ethicalcheck.properties.json b/code-scanning/properties/ethicalcheck.properties.json index c0949be..8728ca7 100644 --- a/code-scanning/properties/ethicalcheck.properties.json +++ b/code-scanning/properties/ethicalcheck.properties.json @@ -1,7 +1,7 @@ { "name": "EthicalCheck", "creator": "APIsec", - "description": "EthicalCheck addresses the critical need to continuously security test APIs in development and in production. EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list. Developers relies on EthicalCheck to evaluate every update and release, ensuring that no APIs go to production with exploitable vulnerabilities. You develop the application and API, we bring complete and continuous security testing to you, accelerating development.Know your API and Applications are secure with EthicalCheck – our free & automated API security testing service.", + "description": "EthicalCheck provides the industry’s only free & automated API security testing service that uncovers security vulnerabilities using OWASP API list.", "iconName": "apisec", "categories": [ "Code Scanning",