Merge branch 'main' into add-credo-workflow
This commit is contained in:
ElizabethBarrord
@@ -10,7 +10,7 @@
|
||||
# How to Get Started with APIsec.ai
|
||||
# 1. Schedule a demo at https://www.apisec.ai/request-a-demo .
|
||||
#
|
||||
# 2. Register your account at https://cloud.fxlabs.io/#/signup .
|
||||
# 2. Register your account at https://cloud.apisec.ai/#/signup .
|
||||
#
|
||||
# 3. Register your API . See the video (https://www.youtube.com/watch?v=MK3Xo9Dbvac) to get up and running with APIsec quickly.
|
||||
#
|
||||
@@ -55,7 +55,7 @@ jobs:
|
||||
|
||||
steps:
|
||||
- name: APIsec scan
|
||||
uses: apisec-inc/apisec-run-scan@f748a240d69ca6cd7e9532fd0a47bec4ccd6a73c
|
||||
uses: apisec-inc/apisec-run-scan@025432089674a28ba8fb55f8ab06c10215e772ea
|
||||
with:
|
||||
# The APIsec username with which the scans will be executed
|
||||
apisec-username: ${{ secrets.apisec_username }}
|
||||
|
||||
@@ -77,7 +77,7 @@ jobs:
|
||||
fi
|
||||
|
||||
DETEKT_DOWNLOAD_URL=$(jq --raw-output '.data.repository.release.releaseAssets.nodes[0].downloadUrl' gh_response.json)
|
||||
echo "::set-output name=download_url::$DETEKT_DOWNLOAD_URL"
|
||||
echo "download_url=$DETEKT_DOWNLOAD_URL" >> $GITHUB_OUTPUT
|
||||
|
||||
# Sets up the detekt cli
|
||||
- name: Setup Detekt
|
||||
|
||||
@@ -7,8 +7,7 @@
|
||||
# Uses JFrog Xray to scan the project.
|
||||
# Read more about Frogbot here - https://github.com/jfrog/frogbot#frogbot
|
||||
|
||||
# Frogbot uses a frogbot-config.yml file to run. The following article will guide you through the process of creating this file:
|
||||
# https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
# Some projects require creating a frogbot-config.yml file. Read more about it here - https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
|
||||
name: "Frogbot Scan and Fix"
|
||||
on:
|
||||
@@ -26,10 +25,17 @@ jobs:
|
||||
|
||||
# IMPORTANT:
|
||||
# 1. See the following link for information about the tools that need to be installed for Frogbot to work - https://github.com/jfrog/frogbot/tree/master/docs/templates/github-actions/scan-and-fix
|
||||
# 2. Frogbot requires a frogbot-config.yml to run. Read more about in the following link - https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
# 2. Some projects require creating a frogbot-config.yml file. Read more about it here - https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
|
||||
- uses: jfrog/frogbot@8daba7e9515dbc898012367c71c1018449cd7716
|
||||
- uses: jfrog/frogbot@3395426f351556d4568e30a6dfd2909dbedae99e
|
||||
env:
|
||||
# [Mandatory if the two conditions below are met]
|
||||
# 1. The project uses npm, yarn 2, NuGet or .NET to download its dependencies
|
||||
# 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
|
||||
#
|
||||
# The command that installs the project dependencies (e.g "npm i", "nuget restore" or "dotnet restore")
|
||||
# JF_INSTALL_DEPS_CMD: ""
|
||||
|
||||
# [Mandatory]
|
||||
# JFrog platform URL
|
||||
JF_URL: ${{ secrets.JF_URL }}
|
||||
@@ -38,14 +44,26 @@ jobs:
|
||||
# JFrog access token with 'read' permissions on Xray service
|
||||
JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
|
||||
|
||||
# [Mandatory]
|
||||
# The GitHub token automatically generated for the job
|
||||
JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# [Mandatory if JF_ACCESS_TOKEN is not provided]
|
||||
# JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD
|
||||
# JF_USER: ${{ secrets.JF_USER }}
|
||||
|
||||
# [Mandatory if JF_ACCESS_TOKEN is not provided]
|
||||
# JFrog password. Must be provided with JF_USER
|
||||
# JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
|
||||
# JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
|
||||
|
||||
# [Mandatory]
|
||||
# The GitHub token automatically generated for the job
|
||||
JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# [Optional]
|
||||
# If the machine that runs Frogbot has no access to the internat, set the name of a remote repository
|
||||
# in Artifactory, which proxies https://releases.jfrog.io/artifactory
|
||||
# The 'frogbot' executable and other tools it needs will be downloaded through this repository.
|
||||
# JF_RELEASES_REPO: ""
|
||||
|
||||
# [Optional]
|
||||
# Frogbot will download the project dependencies, if they're not cached locally. To download the
|
||||
# dependencies from a virtual repository in Artifactory, set the name of of the repository. There's no
|
||||
# need to set this value, if it is set in the frogbot-config.yml file.
|
||||
# JF_DEPS_REPO: ""
|
||||
@@ -7,8 +7,7 @@
|
||||
# Uses JFrog Xray to scan the project.
|
||||
# Read more about Frogbot here - https://github.com/jfrog/frogbot#frogbot
|
||||
|
||||
# Frogbot uses a frogbot-config.yml file to run. The following article will guide you through the process of creating this file:
|
||||
# https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
# Some projects require creating a frogbot-config.yml file. Read more about it here - https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
|
||||
name: "Frogbot Scan Pull Request"
|
||||
on:
|
||||
@@ -31,10 +30,17 @@ jobs:
|
||||
|
||||
# IMPORTANT:
|
||||
# 1. See the following link for information about the tools that need to be installed for Frogbot to work - https://github.com/jfrog/frogbot/tree/master/docs/templates/github-actions/scan-and-fix
|
||||
# 2. Frogbot requires a frogbot-config.yml to run. Read more about in the following link - https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
# 2. Some projects require creating a frogbot-config.yml file. Read more about it here - https://github.com/jfrog/frogbot/blob/master/docs/frogbot-config.md
|
||||
|
||||
- uses: jfrog/frogbot@8daba7e9515dbc898012367c71c1018449cd7716
|
||||
- uses: jfrog/frogbot@3395426f351556d4568e30a6dfd2909dbedae99e
|
||||
env:
|
||||
# [Mandatory if the two conditions below are met]
|
||||
# 1. The project uses npm, yarn 2, NuGet or .NET to download its dependencies
|
||||
# 2. The `installCommand` variable isn't set in your frogbot-config.yml file.
|
||||
#
|
||||
# The command that installs the project dependencies (e.g "npm i", "nuget restore" or "dotnet restore")
|
||||
# JF_INSTALL_DEPS_CMD: ""
|
||||
|
||||
# [Mandatory]
|
||||
# JFrog platform URL
|
||||
JF_URL: ${{ secrets.JF_URL }}
|
||||
@@ -43,14 +49,26 @@ jobs:
|
||||
# JFrog access token with 'read' permissions on Xray service
|
||||
JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
|
||||
|
||||
# [Mandatory]
|
||||
# The GitHub token automatically generated for the job
|
||||
JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# [Mandatory if JF_ACCESS_TOKEN is not provided]
|
||||
# JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD
|
||||
# JF_USER: ${{ secrets.JF_USER }}
|
||||
|
||||
# [Mandatory if JF_ACCESS_TOKEN is not provided]
|
||||
# JFrog password. Must be provided with JF_USER
|
||||
# JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
|
||||
# JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
|
||||
|
||||
# [Mandatory]
|
||||
# The GitHub token automatically generated for the job
|
||||
JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# [Optional]
|
||||
# If the machine that runs Frogbot has no access to the internat, set the name of a remote repository
|
||||
# in Artifactory, which proxies https://releases.jfrog.io/artifactory
|
||||
# The 'frogbot' executable and other tools it needs will be downloaded through this repository.
|
||||
# JF_RELEASES_REPO: ""
|
||||
|
||||
# [Optional]
|
||||
# Frogbot will download the project dependencies, if they're not cached locally. To download the
|
||||
# dependencies from a virtual repository in Artifactory, set the name of of the repository. There's no
|
||||
# need to set this value, if it is set in the frogbot-config.yml file.
|
||||
# JF_DEPS_REPO: ""
|
||||
@@ -0,0 +1,7 @@
|
||||
{
|
||||
"name": "Snyk Security",
|
||||
"creator": "Snyk",
|
||||
"description": "Detect vulnerabilities across your applications and infrastructure with the Snyk platform.",
|
||||
"iconName": "snyk",
|
||||
"categories": ["Code Scanning","JavaScript", "Python", "Java", "PHP", "C#", "C", "C++", "Ruby", "Swift", "Go", "TypeScript", "Kotlin", "Apex", "Scala", "Terraform", "Dockerfile"]
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
# This workflow uses actions that are not certified by GitHub.
|
||||
# They are provided by a third-party and are governed by
|
||||
# separate terms of service, privacy policy, and support
|
||||
# documentation.
|
||||
|
||||
# A sample workflow which sets up Snyk to analyze the full Snyk platform (Snyk Open Source, Snyk Code,
|
||||
# Snyk Container and Snyk Infrastructure as Code)
|
||||
# The setup installs the Snyk CLI - for more details on the possible commands
|
||||
# check https://docs.snyk.io/snyk-cli/cli-reference
|
||||
# The results of Snyk Code are then uploaded to GitHub Security Code Scanning
|
||||
#
|
||||
# In order to use the Snyk Action you will need to have a Snyk API token.
|
||||
# More details in https://github.com/snyk/actions#getting-your-snyk-token
|
||||
# or you can signup for free at https://snyk.io/login
|
||||
#
|
||||
# For more examples, including how to limit scans to only high-severity issues
|
||||
# and fail PR checks, see https://github.com/snyk/actions/
|
||||
|
||||
name: Snyk Security
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [$default-branch, $protected-branches]
|
||||
pull_request:
|
||||
branches: [$default-branch]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
snyk:
|
||||
permissions:
|
||||
contents: read # for actions/checkout to fetch code
|
||||
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
|
||||
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Set up Snyk CLI to check for security issues
|
||||
# Snyk can be used to break the build when it detects security issues.
|
||||
# In this case we want to upload the SAST issues to GitHub Code Scanning
|
||||
uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
|
||||
|
||||
# For Snyk Open Source you must first set up the development environment for your application's dependencies
|
||||
# For example for Node
|
||||
#- uses: actions/setup-node@v3
|
||||
# with:
|
||||
# node-version: 16
|
||||
|
||||
env:
|
||||
# This is where you will need to introduce the Snyk API token created with your Snyk account
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
|
||||
# Runs Snyk Code (SAST) analysis and uploads result into GitHub.
|
||||
# Use || true to not fail the pipeline
|
||||
- name: Snyk Code test
|
||||
run: snyk code test --sarif > snyk-code.sarif # || true
|
||||
|
||||
# Runs Snyk Open Source (SCA) analysis and uploads result to Snyk.
|
||||
- name: Snyk Open Source monitor
|
||||
run: snyk monitor --all-projects
|
||||
|
||||
# Runs Snyk Infrastructure as Code (IaC) analysis and uploads result to Snyk.
|
||||
# Use || true to not fail the pipeline.
|
||||
- name: Snyk IaC test and report
|
||||
run: snyk iac test --report # || true
|
||||
|
||||
# Build the docker image for testing
|
||||
- name: Build a Docker image
|
||||
run: docker build -t your/image-to-test .
|
||||
# Runs Snyk Container (Container and SCA) analysis and uploads result to Snyk.
|
||||
- name: Snyk Container monitor
|
||||
run: snyk container monitor your/image-to-test --file=Dockerfile
|
||||
|
||||
# Push the Snyk Code results into GitHub Code Scanning tab
|
||||
- name: Upload result to GitHub Code Scanning
|
||||
uses: github/codeql-action/upload-sarif@v2
|
||||
with:
|
||||
sarif_file: snyk-code.sarif
|
||||
Reference in New Issue
Block a user