Add Mayhem for API code scanning workflow

2021-04-12 14:50:41 -04:00
parent fc65e636f2
commit 97a16c82c5
3 changed files with 88 additions and 0 deletions
@@ -0,0 +1,62 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# This workflow starts your API and fuzzes it with ForAllSecure Mayhem for API
+# to find reliability, performance and security issues before they reach
+# production.
+#
+# To use this workflow, you will need to:
+#
+# 1. Create a Mayhem for API account at
+#    https://mayhem4api.forallsecure.com/signup (30-day free trial)
+#
+# 2. Create a service account token `mapi organization service-account create
+#    <org-name> <service-account-name>`
+#
+# 3. Add the service account token as a secret in GitHub called "MAPI_TOKEN"
+#
+# 4. Update the "Start your API" step to run your API in the background before
+#    starting the Mayhem for API scan, and update the `api-url` & `api-spec`
+#    field.
+#
+# If you have any questions, please contact us at mayhem4api@forallsecure.com
+
+name: "Mayhem for API"
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ $default-branch ]
+
+jobs:
+  mayhem-for-api:
+    name: Mayhem for API
+    # Mayhem for API runs on linux, mac and windows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      # Run your API in the background. Ideally, the API would run in debug
+      # mode & send stacktraces back on "500 Internal Server Error" responses
+      # (don't do this in production though!)
+      - name: Start your API
+        run: ./run_your_api.sh & # <- ✏️ update this
+
+      - name: Mayhem for API
+        uses: ForAllSecure/mapi-action@193b709971cc377675e33284aecbf9229853e010
+        continue-on-error: true
+        with:
+          mapi-token: ${{ secrets.MAPI_TOKEN }}
+          api-url: http://localhost:8080 # <- ✏️ update this
+          api-spec: http://localhost:8080/openapi.json # <- ✏️ update this
+          duration: 60
+          sarif-report: mapi.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: mapi.sarif
@@ -0,0 +1,7 @@
+{
+    "name": "Mayhem for API",
+    "creator": "ForAllSecure",
+    "description": "Automatically test your REST APIs with your OpenAPI specs and Postman collections",
+    "iconName": "mayhem-for-api",
+    "categories": ["Code Scanning", "C#", "Go", "Java", "Scala", "JavaScript", "TypeScript", "Ruby", "PHP", "Swift", "Kotlin" , "Python", "Rust", "Objective C"]
+}
@@ -0,0 +1,19 @@
+<svg width="75" height="76" viewBox="0 0 75 76" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M37.2411 0.878906C16.7411 0.878906 0.121094 17.4989 0.121094 37.9989C0.121094 58.4989 16.7411 75.1189 37.2411 75.1189C57.7411 75.1189 74.3611 58.4989 74.3611 37.9989C74.3611 17.4989 57.7411 0.878906 37.2411 0.878906ZM10.8911 52.7989H8.94109L19.7111 23.9889H21.6611L10.8911 52.7989ZM41.5211 52.7989H36.0711L25.3011 23.8489H30.7511L37.3711 41.7589L43.9911 23.9789H45.9411L38.4111 44.3589L41.5211 52.7989ZM60.9911 52.7989L50.2211 23.8489H55.6711L66.4411 52.7889H60.9911V52.7989Z" fill="url(#paint0_linear)"/>
+<path d="M50.2227 23.8477L60.9927 52.7977H66.4427L55.6727 23.8477H50.2227Z" fill="white"/>
+<path d="M8.94141 52.8005H10.8914L21.6614 23.9805H19.7114L8.94141 52.8005Z" fill="white"/>
+<path d="M30.7508 23.8477H25.3008L36.0708 52.7977H41.5208L38.4108 44.3577L37.3708 41.7677L30.7508 23.8477Z" fill="white"/>
+<path d="M43.9911 23.9805L37.3711 41.7705L38.4111 44.3605L45.9311 23.9805H43.9911Z" fill="white"/>
+<defs>
+<linearGradient id="paint0_linear" x1="-67.5437" y1="-66.7809" x2="59.5353" y2="60.2982" gradientUnits="userSpaceOnUse">
+<stop stop-color="#4029B7"/>
+<stop offset="0.1093" stop-color="#4C2AAF"/>
+<stop offset="0.3056" stop-color="#6B2E9B"/>
+<stop offset="0.5643" stop-color="#9D3379"/>
+<stop offset="0.6993" stop-color="#BA3666"/>
+<stop offset="0.7816" stop-color="#D13957"/>
+<stop offset="0.9026" stop-color="#EE3C44"/>
+<stop offset="0.9719" stop-color="#F93D3D"/>
+</linearGradient>
+</defs>
+</svg>