From a2e5f8e5480715e8fcec103ec5c179ac65bac41b Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 18:37:01 +0100 Subject: [PATCH 1/7] Add tfsec starter action --- .../properties/tfsec.properties.json | 7 ++++ code-scanning/tfsec.yml | 35 +++++++++++++++++++ icons/tfsec.svg | 1 + 3 files changed, 43 insertions(+) create mode 100644 code-scanning/properties/tfsec.properties.json create mode 100644 code-scanning/tfsec.yml create mode 100644 icons/tfsec.svg diff --git a/code-scanning/properties/tfsec.properties.json b/code-scanning/properties/tfsec.properties.json new file mode 100644 index 0000000..0ecfb53 --- /dev/null +++ b/code-scanning/properties/tfsec.properties.json @@ -0,0 +1,7 @@ +{ + "name": "tfsec", + "creator": "tfsec", + "description": "Static analysis for Terraform.", + "iconName": "tfsec", + "categories": ["Code Scanning"] +} diff --git a/code-scanning/tfsec.yml b/code-scanning/tfsec.yml new file mode 100644 index 0000000..d06e719 --- /dev/null +++ b/code-scanning/tfsec.yml @@ -0,0 +1,35 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: tfsec + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +jobs: + tfsec: + name: Run tfsec sarif report + runs-on: ubuntu-latest + + steps: + - name: Clone repo + uses: actions/checkout@master + + - name: Run tfsec + uses: tfsec/tfsec-sarif-action@v0.0.4 + with: + sarif_file: tfsec.sarif + github_token: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v1 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: tfsec.sarif \ No newline at end of file diff --git a/icons/tfsec.svg b/icons/tfsec.svg new file mode 100644 index 0000000..6d78f75 --- /dev/null +++ b/icons/tfsec.svg @@ -0,0 +1 @@ + \ No newline at end of file From b80a1555aa6242b8543299266ccbaf38ac49f5ff Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 18:45:51 +0100 Subject: [PATCH 2/7] Update code-scanning/tfsec.yml Co-authored-by: John Bohannon --- code-scanning/tfsec.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/code-scanning/tfsec.yml b/code-scanning/tfsec.yml index d06e719..0b91d26 100644 --- a/code-scanning/tfsec.yml +++ b/code-scanning/tfsec.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Clone repo - uses: actions/checkout@master + uses: actions/checkout@v2 - name: Run tfsec uses: tfsec/tfsec-sarif-action@v0.0.4 @@ -32,4 +32,4 @@ jobs: uses: github/codeql-action/upload-sarif@v1 with: # Path to SARIF file relative to the root of the repository - sarif_file: tfsec.sarif \ No newline at end of file + sarif_file: tfsec.sarif From 4adf815cfcd663e714d9656c85cc9be36f2ea92f Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 18:53:21 +0100 Subject: [PATCH 3/7] update to use the hash rather than tag --- code-scanning/tfsec.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/tfsec.yml b/code-scanning/tfsec.yml index 0b91d26..05879a1 100644 --- a/code-scanning/tfsec.yml +++ b/code-scanning/tfsec.yml @@ -23,7 +23,7 @@ jobs: uses: actions/checkout@v2 - name: Run tfsec - uses: tfsec/tfsec-sarif-action@v0.0.4 + uses: tfsec/tfsec-sarif-action@2ec44316ed27c50d48c931c3c628adc4c8bb1d2b with: sarif_file: tfsec.sarif github_token: ${{ secrets.GITHUB_TOKEN }} From cabc659a07e308ca1cedd4185279b64ed80eddb2 Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 19:16:05 +0100 Subject: [PATCH 4/7] some tweaks for appearance Improve the description, make it more punchy :-) Use a better SVG for the icon --- .../properties/tfsec.properties.json | 2 +- icons/tfsec.svg | 37 ++++++++++++++++++- 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/code-scanning/properties/tfsec.properties.json b/code-scanning/properties/tfsec.properties.json index 0ecfb53..1a6a2f0 100644 --- a/code-scanning/properties/tfsec.properties.json +++ b/code-scanning/properties/tfsec.properties.json @@ -1,7 +1,7 @@ { "name": "tfsec", "creator": "tfsec", - "description": "Static analysis for Terraform.", + "description": "A static analysis security scanner for your Terraform code. Discover problems with your infrastructure before hackers do.", "iconName": "tfsec", "categories": ["Code Scanning"] } diff --git a/icons/tfsec.svg b/icons/tfsec.svg index 6d78f75..a68cb4c 100644 --- a/icons/tfsec.svg +++ b/icons/tfsec.svg @@ -1 +1,36 @@ - \ No newline at end of file + +image/svg+xml \ No newline at end of file From 678e77e33cf6cfafd482dfc6844cf29810fad5ac Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 19:27:00 +0100 Subject: [PATCH 5/7] fix the svg to make it nicer --- icons/tfsec.svg | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/icons/tfsec.svg b/icons/tfsec.svg index a68cb4c..5e04b87 100644 --- a/icons/tfsec.svg +++ b/icons/tfsec.svg @@ -21,16 +21,16 @@ id="g12"> \ No newline at end of file + d="M 296.3 217.1 c 37.2 16.7 73 31.2 107.5 43.6 c 53 18.9 103.3 32.7 152.1 41.6 v 115.9 C 499.5 407.9 441.2 391 379 367.3 C 343.9 354 307.6 338.5 269.7 320.8 C 276.5 285.7 285.3 251 296.3 217.1" /> \ No newline at end of file From 78f5a8e8b5eac295f3bc3855f0c4d109aaf18cd2 Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 19:35:46 +0100 Subject: [PATCH 6/7] center the icon better --- icons/tfsec.svg | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/icons/tfsec.svg b/icons/tfsec.svg index 5e04b87..60b6014 100644 --- a/icons/tfsec.svg +++ b/icons/tfsec.svg @@ -5,7 +5,7 @@ xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" - viewBox="0 0 180 180" + viewBox="0 0 120 120" height="180" width="180" xml:space="preserve" @@ -21,16 +21,16 @@ id="g12"> \ No newline at end of file + d="M 65.6 456 c 37.2 16.7 73 31.2 107.5 43.6 c 53 18.9 103.3 32.7 152.1 41.6 v 115.9 C 268.8 646.8 210.5 629.9 148.3 606.2 C 113.2 592.9 76.9 577.4 39 559.7 C 45.8 524.6 54.6 489.9 65.6 456" /> \ No newline at end of file From 7dab5895e67103ca158b93552580f6918b6a0524 Mon Sep 17 00:00:00 2001 From: Owen Rumney Date: Wed, 14 Apr 2021 20:17:04 +0100 Subject: [PATCH 7/7] add HCL as a category --- code-scanning/properties/tfsec.properties.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/properties/tfsec.properties.json b/code-scanning/properties/tfsec.properties.json index 1a6a2f0..6796d79 100644 --- a/code-scanning/properties/tfsec.properties.json +++ b/code-scanning/properties/tfsec.properties.json @@ -3,5 +3,5 @@ "creator": "tfsec", "description": "A static analysis security scanner for your Terraform code. Discover problems with your infrastructure before hackers do.", "iconName": "tfsec", - "categories": ["Code Scanning"] + "categories": ["Code Scanning", "HCL"] }