Merge branch 'main' into feature/stackhawk-hawkscan

2021-08-04 08:52:57 -06:00
parent bcb74bbea1 7135450ec1
commit 3b211c9073
13 changed files with 181 additions and 17 deletions
@@ -10,7 +10,8 @@ These are the workflow files for helping people get started with GitHub Actions.

 <img src="https://d3vv6lp55qjaqc.cloudfront.net/items/353A3p3Y2x3c2t2N0c01/Image%202019-08-27%20at%203.25.07%20PM.png" max-width="75%"/>

-**Directory structure:**
+### Directory structure
+
 * [ci](ci): solutions for Continuous Integration
 * [automation](automation): solutions for automating workflows.
 * [code-scanning](code-scanning): starter workflows for [Code Scanning](https://github.com/features/security)
@@ -20,8 +21,16 @@ Each workflow must be written in YAML and have a `.yml` extension. They also nee

 For example: `ci/django.yml` and `ci/properties/django.properties.json`.

-**Valid properties:**
+### Valid properties
+
 * `name`: the name shown in onboarding
 * `description`: the description shown in onboarding
 * `iconName`: the icon name in the relevant folder, for example `django` should have an icon `icons/django.svg`. Only SVG is supported at this time
 * `categories`: the categories that it will be shown under
+
+### Variables
+These variables can be placed in the starter workflow and will be substituted as detailed below:
+
+* `$default-branch`: will substitute the branch from the repository, for example `main` and `master`
+* `$protected-branches`: will substitue any protected branches from the repository.
+* `$cron-daily`: will substitute a valid but random time within the day
@@ -3,7 +3,7 @@
 # separate terms of service, privacy policy, and support
 # documentation.

-# This workflow will install Deno and run tests across stable and canary builds on Windows, Ubuntu and macOS.
+# This workflow will install Deno then run Deno lint and test.
 # For more information see: https://github.com/denoland/setup-deno

 name: Deno
@@ -16,12 +16,7 @@ on:

 jobs:
  test:
-    runs-on: ${{ matrix.os }} # runs a test on Ubuntu, Windows and macOS
-
-    strategy:
-      matrix:
-        deno: ["v1.x", "canary"]
-        os: [macOS-latest, windows-latest, ubuntu-latest]
+    runs-on: ubuntu-latest

    steps:
      - name: Setup repo
@@ -29,9 +24,9 @@ jobs:

      - name: Setup Deno
        # uses: denoland/setup-deno@v1
-        uses: denoland/setup-deno@4a4e59637fa62bd6c086a216c7e4c5b457ea9e79
+        uses: denoland/setup-deno@004814556e37c54a2f6e31384c9e18e9833173669
        with:
-          deno-version: ${{ matrix.deno }} # tests across multiple Deno versions
+          deno-version: v1.x

      # Uncomment this step to verify the use of 'deno fmt' on each commit.
      # - name: Verify formatting
@@ -40,8 +35,5 @@ jobs:
      - name: Run linter
        run: deno lint

-      - name: Cache dependencies
-        run: deno cache deps.ts
-
      - name: Run tests
        run: deno test -A --unstable
@@ -0,0 +1,28 @@
+name: NodeJS with Grunt
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 16.x]
+    
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build
+      run: |
+        npm install
+        grunt
@@ -0,0 +1,28 @@
+name: NodeJS with Gulp
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 16.x]
+    
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build
+      run: |
+        npm install
+        gulp
@@ -26,7 +26,7 @@ jobs:
          platform: ${{ 'iOS Simulator' }}
        run: |
          # xcrun xctrace returns via stderr, not the expected stdout (see https://developer.apple.com/forums/thread/663959)
-          device=`xcrun xctrace list devices 2>&1 | grep -oE 'iPhone.*?[^\(]+' | head -1 | awk '{$1=$1;print}'``
+          device=`xcrun xctrace list devices 2>&1 | grep -oE 'iPhone.*?[^\(]+' | head -1 | awk '{$1=$1;print}'`
          if [ $scheme = default ]; then scheme=$(cat default); fi
          if [ "`ls -A | grep -i \\.xcworkspace\$`" ]; then filetype_parameter="workspace" && file_to_build="`ls -A | grep -i \\.xcworkspace\$`"; else filetype_parameter="project" && file_to_build="`ls -A | grep -i \\.xcodeproj\$`"; fi
          file_to_build=`echo $file_to_build | awk '{$1=$1;print}'`
@@ -0,0 +1,6 @@
+{
+    "name": "Grunt",
+    "description": "Build a NodeJS project with npm and grunt.",
+    "iconName": "grunt",
+    "categories": ["JavaScript", "TypeScript", "npm", "Grunt"]
+}
@@ -0,0 +1,6 @@
+{
+    "name": "Gulp",
+    "description": "Build a NodeJS project with npm and gulp.",
+    "iconName": "gulp",
+    "categories": ["JavaScript", "TypeScript", "npm", "Gulp"]
+}
@@ -0,0 +1,6 @@
+{
+    "name": "Webpack",
+    "description": "Build a NodeJS project with npm and webpack.",
+    "iconName": "webpack",
+    "categories": ["JavaScript", "TypeScript", "npm", "Webpack"]
+}
@@ -43,7 +43,7 @@ jobs:

    - name: Login TKE Registry
      run: |
-        docker login -u ${{ secrets.TENCENT_CLOUD_ACCOUNT_ID }} -p ${{ secrets.TKE_REGISTRY_PASSWORD }} ${TKE_IMAGE_URL}
+        docker login -u ${{ secrets.TENCENT_CLOUD_ACCOUNT_ID }} -p '${{ secrets.TKE_REGISTRY_PASSWORD }}' ${TKE_IMAGE_URL}

    # Push the Docker image to TKE Registry
    - name: Publish
@@ -73,4 +73,4 @@ jobs:
        ./kustomize edit set image ${TKE_IMAGE_URL}:${GITHUB_SHA}
        ./kustomize build . | kubectl apply -f -
        kubectl rollout status deployment/${DEPLOYMENT_NAME}
-        kubectl get services -o wide
+        kubectl get services -o wide
@@ -0,0 +1,28 @@
+name: NodeJS with Webpack
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [12.x, 14.x, 16.x]
+    
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build
+      run: |
+        npm install
+        npx webpack
@@ -0,0 +1,38 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: flawfinder
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ $default-branch ]
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  flawfinder:
+    name: Flawfinder
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: flawfinder_scan
+        uses: david-a-wheeler/flawfinder@8e4a779ad59dbfaee5da586aa9210853b701959c
+        with:
+          arguments: '--sarif ./'
+          output: 'flawfinder_results.sarif'
+
+      - name: Upload analysis results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: ${{github.workspace}}/flawfinder_results.sarif
@@ -0,0 +1,7 @@
+{
+    "name": "Flawfinder",
+    "creator": "David A. Wheeler",
+    "description": "Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws.",
+    "iconName": "flawfinder",
+    "categories": [ "Code Scanning", "C", "C++" ]
+}
@@ -0,0 +1,16 @@
+<svg width="28" height="28" viewBox="0 0 28 28" fill="none" xmlns="http://www.w3.org/2000/svg">
+<circle cx="14" cy="14" r="14" fill="#C4C4C4"/>
+<mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="28" height="28">
+<circle cx="14" cy="14" r="14" fill="#CCCCCC"/>
+</mask>
+<g mask="url(#mask0)">
+<path d="M16 17V11M22 6H16V11M16 11H20" stroke="black" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<path d="M12 17V11M6 6H12V11M12 11H8" stroke="black" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+<circle cx="14" cy="30" r="14" fill="#333333"/>
+<circle cx="17" cy="21" r="2" fill="white"/>
+<circle cx="17" cy="21" r="1" fill="black"/>
+<circle cx="11" cy="21" r="2" fill="white"/>
+<circle cx="11" cy="21" r="1" fill="black"/>
+<path d="M11.5 25C11.5 25 12.5 25.5 14 25.5C15.5 25.5 16.5 25 16.5 25" stroke="white" stroke-linecap="round"/>
+</g>
+</svg>