From 469c22e7a4158aa9cf13543c2614ef2561b57e95 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 19 Mar 2024 12:45:34 -0400 Subject: [PATCH 01/29] ci/python-publish: bump, use trusted publishing Signed-off-by: William Woodruff --- ci/python-publish.yml | 58 +++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 22 deletions(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index bdaab28..160b12f 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -1,4 +1,4 @@ -# This workflow will upload a Python Package using Twine when a release is created +# This workflow will upload a Python Package to PyPI when a release is created # For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries # This workflow uses actions that are not certified by GitHub. @@ -12,28 +12,42 @@ on: release: types: [published] -permissions: - contents: read - jobs: - deploy: - + release-build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - name: Set up Python - uses: actions/setup-python@v3 - with: - python-version: '3.x' - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install build - - name: Build package - run: python -m build - - name: Publish package - uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29 - with: - user: __token__ - password: ${{ secrets.PYPI_API_TOKEN }} + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: "3.x" + + - name: build release distributions + run: | + # NOTE: put your own distribution build steps here. + python -m pip install build + python -m build + + - name: upload distributions + uses: actions/upload-artifact@v4 + with: + name: release-dists + path: dist/ + + pypi-publish: + runs-on: ubuntu-latest + needs: + - release-build + permissions: + id-token: write + + steps: + - name: Retrieve release distributions + uses: actions/download-artifact@v4 + with: + name: release-dists + path: dist/ + + - name: Publish release distributions to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 From f4c64fb836ab3e5b6e5c99f3fb47241e56178445 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 19 Mar 2024 15:40:07 -0400 Subject: [PATCH 02/29] Apply suggestions from code review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sviatoslav Sydorenko (Святослав Сидоренко) --- ci/python-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 160b12f..ec73a48 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -23,13 +23,13 @@ jobs: with: python-version: "3.x" - - name: build release distributions + - name: Build release distributions run: | # NOTE: put your own distribution build steps here. python -m pip install build python -m build - - name: upload distributions + - name: Upload distributions uses: actions/upload-artifact@v4 with: name: release-dists From 231e6b5f6f635625f600d423d7fba591d99dfa47 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 19 Mar 2024 16:41:37 -0400 Subject: [PATCH 03/29] python-publish: contents: read at toplevel Signed-off-by: William Woodruff --- ci/python-publish.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index ec73a48..51b96ca 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -12,6 +12,9 @@ on: release: types: [published] +permissions: + contents: read + jobs: release-build: runs-on: ubuntu-latest From e23021529279bb3abf1f7253df1e3eb3bbe23a51 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 19 Mar 2024 16:42:35 -0400 Subject: [PATCH 04/29] python-publish: explanatory comment Signed-off-by: William Woodruff --- ci/python-publish.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 51b96ca..7675071 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -43,6 +43,7 @@ jobs: needs: - release-build permissions: + # IMPORTANT: this permission is mandatory for trusted publishing id-token: write steps: From 1fa8e1835028aa47cdb324027fc7c3bd8f93f875 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 19 Mar 2024 16:49:45 -0400 Subject: [PATCH 05/29] python-publish: copy gem-push.yml's pattern Signed-off-by: William Woodruff --- ci/python-publish.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 7675071..bb92010 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -54,4 +54,6 @@ jobs: path: dist/ - name: Publish release distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + # To automatically get updates, change this to: + # uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14 From e44c7b519f7b4a81d578eddc0fa12e6463d45271 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 19 Mar 2024 16:57:58 -0400 Subject: [PATCH 06/29] python-publish: environment Signed-off-by: William Woodruff --- ci/python-publish.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index bb92010..bf13220 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -46,6 +46,13 @@ jobs: # IMPORTANT: this permission is mandatory for trusted publishing id-token: write + # Dedicated environments with protections for publishing are strongly recommended. + # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules + environment: + name: pypi + # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status: + # url: https://pypi.org/p/YOURPROJECT + steps: - name: Retrieve release distributions uses: actions/download-artifact@v4 From fdb3717e44c9c423a0acf005ee67c5ffaa043eb5 Mon Sep 17 00:00:00 2001 From: daz Date: Wed, 7 Aug 2024 11:04:34 -0600 Subject: [PATCH 07/29] Update for `gradle/actions@v4.0.0` release - Bump version hashes to use `gradle/actions/setup-gradle@v4.0.0` - Bump version hash to use `gradle/actions/dependency-submission@v4.0.0` --- ci/gradle-publish.yml | 2 +- ci/gradle.yml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ci/gradle-publish.yml b/ci/gradle-publish.yml index 4f36680..20d17dc 100644 --- a/ci/gradle-publish.yml +++ b/ci/gradle-publish.yml @@ -30,7 +30,7 @@ jobs: settings-path: ${{ github.workspace }} # location for the settings.xml file - name: Setup Gradle - uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2 + uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0 - name: Build with Gradle run: ./gradlew build diff --git a/ci/gradle.yml b/ci/gradle.yml index eb756d0..40a40c1 100644 --- a/ci/gradle.yml +++ b/ci/gradle.yml @@ -31,7 +31,7 @@ jobs: # Configure Gradle for optimal use in GitHub Actions, including caching of downloaded dependencies. # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md - name: Setup Gradle - uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2 + uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0 - name: Build with Gradle Wrapper run: ./gradlew build @@ -40,11 +40,11 @@ jobs: # If your project does not have the Gradle Wrapper configured, you can use the following configuration to run Gradle with a specified version. # # - name: Setup Gradle - # uses: gradle/actions/setup-gradle@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2 + # uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0 # with: - # gradle-version: '8.5' + # gradle-version: '8.9' # - # - name: Build with Gradle 8.5 + # - name: Build with Gradle 8.9 # run: gradle build dependency-submission: @@ -64,4 +64,4 @@ jobs: # Generates and submits a dependency graph, enabling Dependabot Alerts for all project dependencies. # See: https://github.com/gradle/actions/blob/main/dependency-submission/README.md - name: Generate and submit dependency graph - uses: gradle/actions/dependency-submission@dbbdc275be76ac10734476cc723d82dfe7ec6eda # v3.4.2 + uses: gradle/actions/dependency-submission@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0 From af1bbdc4308b034a9d854df319a91d57b7664b5d Mon Sep 17 00:00:00 2001 From: SOOS-GSteen Date: Fri, 16 Aug 2024 11:10:57 -0400 Subject: [PATCH 08/29] Update soos-dast-scan.yml hash (#2466) * Update soos-dast-scan.yml * Update soos-dast-scan.yml * Update soos-dast-scan.yml * Update soos-dast-scan.yml --- code-scanning/soos-dast-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/soos-dast-scan.yml b/code-scanning/soos-dast-scan.yml index b3e470e..0d42c92 100644 --- a/code-scanning/soos-dast-scan.yml +++ b/code-scanning/soos-dast-scan.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run SOOS DAST Analysis - uses: soos-io/soos-dast-github-action@a7f2cb2dfd143cb3224712d902ca0a1da0198ea9 + uses: soos-io/soos-dast-github-action@65d9878d77c8993f3db9e86a92bc2ad3a6e060af with: client_id: ${{ secrets.SOOS_CLIENT_ID }} api_key: ${{ secrets.SOOS_API_KEY }} From 83b6e98d43fce23a60eb247f3c165b79b3c60ad2 Mon Sep 17 00:00:00 2001 From: Michael Chernov <4ernovm@gmail.com> Date: Fri, 16 Aug 2024 18:16:20 +0300 Subject: [PATCH 09/29] Add Debricked starter workflow (#2107) * Add Debricked starter workflow * Add permissions section * Remove schedule * Fix review comments --------- Co-authored-by: Alexis Abril --- code-scanning/debricked.yml | 43 +++++++++++++++++++ .../properties/debricked.properties.json | 19 ++++++++ icons/debricked.svg | 3 ++ 3 files changed, 65 insertions(+) create mode 100644 code-scanning/debricked.yml create mode 100644 code-scanning/properties/debricked.properties.json create mode 100644 icons/debricked.svg diff --git a/code-scanning/debricked.yml b/code-scanning/debricked.yml new file mode 100644 index 0000000..79b0a07 --- /dev/null +++ b/code-scanning/debricked.yml @@ -0,0 +1,43 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +##################################################################################################################################################################### +# Use this workflow template as a basis for integrating Debricked into your GitHub workflows. # +# # +# If you need additional assistance with configuration feel free to contact us via chat or email at support@debricked.com # +# To learn more about Debricked or contact our team, visit https://debricked.com/ # +# # +# To run this workflow, complete the following set-up steps: # +# # +# 1. If you don’t have a Debricked account, create one by visiting https://debricked.com/app/en/register # +# 2. Generate your Debricked access token, by following the steps mentioned in https://portal.debricked.com/administration-47/how-do-i-generate-an-access-token-130 # +# 3. In GitHub, navigate to the repository # +# 4. Click on “Settings” (If you cannot see the “Settings” tab, select the dropdown menu, then click “Settings”) # +# 5. In the “Security” section click on “Secrets and variables”, then click “Actions” # +# 6. In the “Secrets” tab, click on “New repository secret” # +# 7. In the “Name” field, type the name of the secret # +# 8. In the “Secret” field, enter the value of the secret # +# 9. Click “Add secret” # +# 10. You should now be ready to use the workflow! # +##################################################################################################################################################################### + +name: Debricked Scan + +on: + push: + +permissions: + contents: read + +jobs: + vulnerabilities-scan: + name: Vulnerabilities scan + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + - uses: debricked/actions@v3 + env: + DEBRICKED_TOKEN: ${{ secrets.DEBRICKED_TOKEN }} diff --git a/code-scanning/properties/debricked.properties.json b/code-scanning/properties/debricked.properties.json new file mode 100644 index 0000000..f669f09 --- /dev/null +++ b/code-scanning/properties/debricked.properties.json @@ -0,0 +1,19 @@ +{ + "name": "Debricked Scan", + "creator": "OpenText", + "description": "Integrate with Debricked's state of the art AI-powered Software Composition Analysis to automate your security.", + "iconName": "debricked", + "categories": [ + "Code Scanning", + "Python", + "JavaScript", + "Java", + "PHP", + "Ruby", + "Go", + "Rust", + "Swift", + "C#", + "Objective-C" + ] +} diff --git a/icons/debricked.svg b/icons/debricked.svg new file mode 100644 index 0000000..cb8a3d5 --- /dev/null +++ b/icons/debricked.svg @@ -0,0 +1,3 @@ + + + From 5ad49471fe52633f0a7355d1a085bdc6e1d66bcf Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Fri, 16 Aug 2024 12:58:55 -0400 Subject: [PATCH 10/29] Update ci/python-publish.yml Co-authored-by: Gagan Deep --- ci/python-publish.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index bf13220..165ac0a 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -63,4 +63,5 @@ jobs: - name: Publish release distributions to PyPI # To automatically get updates, change this to: # uses: pypa/gh-action-pypi-publish@release/v1 - uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14 + uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0 + From ba125834f1f7cbe9a1e3d363b7b9c9f89e9f7413 Mon Sep 17 00:00:00 2001 From: Ian Lynagh Date: Tue, 20 Aug 2024 12:06:59 +0100 Subject: [PATCH 11/29] CodeQL: Remove Swift 2h timeout Spurious intermittent timeouts are no longer expected on Swift. --- code-scanning/codeql.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 655fc59..3e48389 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -28,7 +28,6 @@ jobs: # - https://gh.io/using-larger-runners (GitHub.com only) # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} - timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} permissions: # required for all workflows security-events: write From 26ad7a75496845c3b4e74d113ff8f6f645fa871b Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 20 Aug 2024 13:39:26 -0400 Subject: [PATCH 12/29] Update ci/python-publish.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sviatoslav Sydorenko (Святослав Сидоренко) --- ci/python-publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 165ac0a..72fdda2 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -52,6 +52,10 @@ jobs: name: pypi # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status: # url: https://pypi.org/p/YOURPROJECT + # + # ALTERNATIVE: if your GitHub Release name is the PyPI project version string + # ALTERNATIVE: exactly, uncomment the following line instead: + # url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }} steps: - name: Retrieve release distributions From ae01bb2a2fa5733aaf305c4161350c9af10345b9 Mon Sep 17 00:00:00 2001 From: Seth Vargo Date: Wed, 21 Aug 2024 11:21:42 -0700 Subject: [PATCH 13/29] google: update workflow versions and instructions (#2478) * google: update workflow versions and instructions * Pin hashes --- deployments/google-cloudrun-docker.yml | 138 ++++++++++------------ deployments/google-cloudrun-source.yml | 112 ++++++++---------- deployments/google.yml | 157 ++++++++++++++----------- 3 files changed, 197 insertions(+), 210 deletions(-) diff --git a/deployments/google-cloudrun-docker.yml b/deployments/google-cloudrun-docker.yml index bd748f8..70af95e 100644 --- a/deployments/google-cloudrun-docker.yml +++ b/deployments/google-cloudrun-docker.yml @@ -1,113 +1,95 @@ -# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Cloud Run when a commit is pushed to the $default-branch branch -# -# Overview: -# -# 1. Authenticate to Google Cloud -# 2. Authenticate Docker to Artifact Registry -# 3. Build a docker container -# 4. Publish it to Google Artifact Registry -# 5. Deploy it to Cloud Run +# This workflow build and push a Docker container to Google Artifact Registry +# and deploy it on Cloud Run when a commit is pushed to the $default-branch +# branch. # # To configure this workflow: # -# 1. Ensure the required Google Cloud APIs are enabled: +# 1. Enable the following Google Cloud APIs: # -# Cloud Run run.googleapis.com -# Artifact Registry artifactregistry.googleapis.com +# - Artifact Registry (artifactregistry.googleapis.com) +# - Cloud Run (run.googleapis.com) +# - IAM Credentials API (iamcredentials.googleapis.com) # -# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) +# You can learn more about enabling APIs at +# https://support.google.com/googleapi/answer/6158841. # -# 3. Ensure the required IAM permissions are granted +# 2. Create and configure a Workload Identity Provider for GitHub: +# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation. # -# Cloud Run -# roles/run.admin -# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) +# Depending on how you authenticate, you will need to grant an IAM principal +# permissions on Google Cloud: # -# Artifact Registry -# roles/artifactregistry.admin (project or repository level) +# - Artifact Registry Administrator (roles/artifactregistry.admin) +# - Cloud Run Developer (roles/run.developer) # -# NOTE: You should always follow the principle of least privilege when assigning IAM roles +# You can learn more about setting IAM permissions at +# https://cloud.google.com/iam/docs/manage-access-other-resources # -# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT -# -# 5. Change the values for the GAR_LOCATION, SERVICE and REGION environment variables (below). -# -# NOTE: To use Google Container Registry instead, replace ${{ env.GAR_LOCATION }}-docker.pkg.dev with gcr.io -# -# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run -# -# Further reading: -# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying -# Artifact Registry IAM permissions - https://cloud.google.com/artifact-registry/docs/access-control#roles -# Container Registry vs Artifact Registry - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry -# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege +# 3. Change the values in the "env" block to match your values. -name: Build and Deploy to Cloud Run +name: 'Build and Deploy to Cloud Run' on: push: - branches: [ $default-branch ] + branches: + - '$default-branch' env: - PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id - GAR_LOCATION: YOUR_GAR_LOCATION # TODO: update Artifact Registry location - SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name - REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region + PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID + REGION: 'us-central1' # TODO: update to your region + SERVICE: 'my-service' # TODO: update to your service name + WORKLOAD_IDENTITY_PROVIDER: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: update to your workload identity provider jobs: deploy: - # Add 'id-token' with the intended permissions for workload identity federation + runs-on: 'ubuntu-latest' + permissions: contents: 'read' id-token: 'write' - runs-on: ubuntu-latest steps: - - name: Checkout - uses: actions/checkout@v2 + - name: 'Checkout' + uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4 - - name: Google Auth - id: auth - uses: 'google-github-actions/auth@v0' + # Configure Workload Identity Federation and generate an access token. + # + # See https://github.com/google-github-actions/auth for more options, + # including authenticating via a JSON credentials file. + - id: 'auth' + name: 'Authenticate to Google Cloud' + uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2 with: - token_format: 'access_token' - workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider - service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com + workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}' - # NOTE: Alternative option - authentication via credentials json - # - name: Google Auth - # id: auth - # uses: 'google-github-actions/auth@v0' - # with: - # credentials_json: '${{ secrets.GCP_CREDENTIALS }}'' - - # BEGIN - Docker auth and build (NOTE: If you already have a container image, these Docker steps can be omitted) - - # Authenticate Docker to Google Cloud Artifact Registry - - name: Docker Auth - id: docker-auth - uses: 'docker/login-action@v1' + # BEGIN - Docker auth and build + # + # If you already have a container image, you can omit these steps. + - name: 'Docker Auth' + uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # docker/login-action@v3 with: username: 'oauth2accesstoken' - password: '${{ steps.auth.outputs.access_token }}' - registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev' + password: '${{ steps.auth.outputs.auth_token }}' + registry: '${{ env.REGION }}-docker.pkg.dev' - - name: Build and Push Container + - name: 'Build and Push Container' run: |- - docker build -t "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" ./ - docker push "${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" + DOCKER_TAG="$${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}" + docker build --tag "${DOCKER_TAG}" . + docker push "${DOCKER_TAG}" + - name: 'Deploy to Cloud Run' - # END - Docker auth and build + # END - Docker auth and build - - name: Deploy to Cloud Run - id: deploy - uses: google-github-actions/deploy-cloudrun@v0 + uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2 with: - service: ${{ env.SERVICE }} - region: ${{ env.REGION }} - # NOTE: If using a pre-built image, update the image name here - image: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }} + service: '${{ env.SERVICE }}' + region: '${{ env.REGION }}' + # NOTE: If using a pre-built image, update the image name below: - # If required, use the Cloud Run url output in later steps - - name: Show Output - run: echo ${{ steps.deploy.outputs.url }} + image: '${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}' + # If required, use the Cloud Run URL output in later steps + - name: 'Show output' + run: |2- + + echo ${{ steps.deploy.outputs.url }} diff --git a/deployments/google-cloudrun-source.yml b/deployments/google-cloudrun-source.yml index e6fcb52..6a9a551 100644 --- a/deployments/google-cloudrun-source.yml +++ b/deployments/google-cloudrun-source.yml @@ -1,95 +1,75 @@ -# This workflow will deploy source code on Cloud Run when a commit is pushed to the $default-branch branch -# -# Overview: -# -# 1. Authenticate to Google Cloud -# 2. Deploy it to Cloud Run +# This workflow will deploy source code on Cloud Run when a commit is pushed to +# the $default-branch branch. # # To configure this workflow: # -# 1. Ensure the required Google Cloud APIs are enabled: +# 1. Enable the following Google Cloud APIs: # -# Cloud Run run.googleapis.com -# Cloud Build cloudbuild.googleapis.com -# Artifact Registry artifactregistry.googleapis.com +# - Artifact Registry (artifactregistry.googleapis.com) +# - Cloud Build (cloudbuild.googleapis.com) +# - Cloud Run (run.googleapis.com) +# - IAM Credentials API (iamcredentials.googleapis.com) # -# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) +# You can learn more about enabling APIs at +# https://support.google.com/googleapi/answer/6158841. # -# 3. Ensure the required IAM permissions are granted +# 2. Create and configure a Workload Identity Provider for GitHub: +# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation. # -# Cloud Run -# roles/run.admin -# roles/iam.serviceAccountUser (to act as the Cloud Run runtime service account) +# Depending on how you authenticate, you will need to grant an IAM principal +# permissions on Google Cloud: # -# Cloud Build -# roles/cloudbuild.builds.editor +# - Artifact Registry Administrator (roles/artifactregistry.admin) +# - Cloud Run Source Developer (roles/run.sourceDeveloper) # -# Cloud Storage -# roles/storage.objectAdmin +# You can learn more about setting IAM permissions at +# https://cloud.google.com/iam/docs/manage-access-other-resources. # -# Artifact Registry -# roles/artifactregistry.admin (project or repository level) -# -# NOTE: You should always follow the principle of least privilege when assigning IAM roles -# -# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT -# -# 5. Change the values for the SERVICE and REGION environment variables (below). -# -# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run -# -# Further reading: -# Cloud Run runtime service account - https://cloud.google.com/run/docs/securing/service-identity -# Cloud Run IAM permissions - https://cloud.google.com/run/docs/deploying-source-code#permissions_required_to_deploy -# Cloud Run builds from source - https://cloud.google.com/run/docs/deploying-source-code -# Principle of least privilege - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege +# 3. Change the values in the "env" block to match your values. -name: Deploy to Cloud Run from Source +name: 'Deploy to Cloud Run from Source' on: push: - branches: [ $default-branch ] + branches: + - '$default-branch' env: - PROJECT_ID: YOUR_PROJECT_ID # TODO: update Google Cloud project id - SERVICE: YOUR_SERVICE_NAME # TODO: update Cloud Run service name - REGION: YOUR_SERVICE_REGION # TODO: update Cloud Run service region + PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID + REGION: 'us-central1' # TODO: update to your region + SERVICE: 'my-service' # TODO: update to your service name jobs: deploy: - # Add 'id-token' with the intended permissions for workload identity federation + runs-on: 'ubuntu-latest' + permissions: contents: 'read' id-token: 'write' - runs-on: ubuntu-latest steps: - - name: Checkout - uses: actions/checkout@v2 + - name: 'Checkout' + uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4 - - name: Google Auth - id: auth - uses: 'google-github-actions/auth@v0' + # Configure Workload Identity Federation and generate an access token. + # + # See https://github.com/google-github-actions/auth for more options, + # including authenticating via a JSON credentials file. + - id: 'auth' + name: 'Authenticate to Google Cloud' + uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2 with: - workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider - service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com + workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: replace with your workload identity provider - # NOTE: Alternative option - authentication via credentials json - # - name: Google Auth - # id: auth - # uses: 'google-github-actions/auth@v0' - # with: - # credentials_json: '${{ secrets.GCP_CREDENTIALS }}' - - - name: Deploy to Cloud Run - id: deploy - uses: google-github-actions/deploy-cloudrun@v0 + - name: 'Deploy to Cloud Run' + uses: 'google-github-actions/deploy-cloudrun@33553064113a37d688aa6937bacbdc481580be17' # google-github-actions/deploy-cloudrun@v2 with: - service: ${{ env.SERVICE }} - region: ${{ env.REGION }} - # NOTE: If required, update to the appropriate source folder - source: ./ + service: '${{ env.SERVICE }}' + region: '${{ env.REGION }}' + # NOTE: If using a different source folder, update the image name below: + source: './' - # If required, use the Cloud Run url output in later steps - - name: Show Output - run: echo ${{ steps.deploy.outputs.url }} + # If required, use the Cloud Run URL output in later steps + - name: 'Show output' + run: |- + echo ${{ steps.deploy.outputs.url }} diff --git a/deployments/google.yml b/deployments/google.yml index deb9877..4be4dc4 100644 --- a/deployments/google.yml +++ b/deployments/google.yml @@ -1,91 +1,116 @@ -# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when there is a push to the $default-branch branch. +# This workflow will build a docker container, publish it to Google Container +# Registry, and deploy it to GKE when there is a push to the $default-branch +# branch. # # To configure this workflow: # -# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc. +# 1. Enable the following Google Cloud APIs: # -# 2. Create and configure a Workload Identity Provider for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation) +# - Artifact Registry (artifactregistry.googleapis.com) +# - Google Kubernetes Engine (container.googleapis.com) +# - IAM Credentials API (iamcredentials.googleapis.com) # -# 3. Change the values for the GAR_LOCATION, GKE_ZONE, GKE_CLUSTER, IMAGE, REPOSITORY and DEPLOYMENT_NAME environment variables (below). +# You can learn more about enabling APIs at +# https://support.google.com/googleapi/answer/6158841. # -# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke-kustomize +# 2. Ensure that your repository contains the necessary configuration for your +# Google Kubernetes Engine cluster, including deployment.yml, +# kustomization.yml, service.yml, etc. +# +# 3. Create and configure a Workload Identity Provider for GitHub: +# https://github.com/google-github-actions/auth#preferred-direct-workload-identity-federation. +# +# Depending on how you authenticate, you will need to grant an IAM principal +# permissions on Google Cloud: +# +# - Artifact Registry Administrator (roles/artifactregistry.admin) +# - Kubernetes Engine Developer (roles/container.developer) +# +# You can learn more about setting IAM permissions at +# https://cloud.google.com/iam/docs/manage-access-other-resources +# +# 5. Change the values in the "env" block to match your values. -name: Build and Deploy to GKE +name: 'Build and Deploy to GKE' on: push: - branches: [ $default-branch ] + branches: + - '$default-branch' env: - PROJECT_ID: ${{ secrets.GKE_PROJECT }} - GAR_LOCATION: us-central1 # TODO: update region of the Artifact Registry - GKE_CLUSTER: cluster-1 # TODO: update to cluster name - GKE_ZONE: us-central1-c # TODO: update to cluster zone - DEPLOYMENT_NAME: gke-test # TODO: update to deployment name - REPOSITORY: samples # TODO: update to Artifact Registry docker repository - IMAGE: static-site + PROJECT_ID: 'my-project' # TODO: update to your Google Cloud project ID + GAR_LOCATION: 'us-central1' # TODO: update to your region + GKE_CLUSTER: 'cluster-1' # TODO: update to your cluster name + GKE_ZONE: 'us-central1-c' # TODO: update to your cluster zone + DEPLOYMENT_NAME: 'gke-test' # TODO: update to your deployment name + REPOSITORY: 'samples' # TODO: update to your Artifact Registry docker repository name + IMAGE: 'static-site' + WORKLOAD_IDENTITY_PROVIDER: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' # TODO: update to your workload identity provider jobs: setup-build-publish-deploy: - name: Setup, Build, Publish, and Deploy - runs-on: ubuntu-latest - environment: production + name: 'Setup, Build, Publish, and Deploy' + runs-on: 'ubuntu-latest' + environment: 'production' permissions: contents: 'read' id-token: 'write' steps: - - name: Checkout - uses: actions/checkout@v4 + - name: 'Checkout' + uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # actions/checkout@v4 - # Configure Workload Identity Federation and generate an access token. - - id: 'auth' - name: 'Authenticate to Google Cloud' - uses: 'google-github-actions/auth@v0' - with: - token_format: 'access_token' - workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' - service_account: 'my-service-account@my-project.iam.gserviceaccount.com' + # Configure Workload Identity Federation and generate an access token. + # + # See https://github.com/google-github-actions/auth for more options, + # including authenticating via a JSON credentials file. + - id: 'auth' + name: 'Authenticate to Google Cloud' + uses: 'google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2' # google-github-actions/auth@v2 + with: + workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}' - # Alternative option - authentication via credentials json - # - id: 'auth' - # uses: 'google-github-actions/auth@v0' - # with: - # credentials_json: '${{ secrets.GCP_CREDENTIALS }}' + # Authenticate Docker to Google Cloud Artifact Registry + - name: 'Docker Auth' + uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # docker/login-action@v3 + with: + username: 'oauth2accesstoken' + password: '${{ steps.auth.outputs.auth_token }}' + registry: '${{ env.GAR_LOCATION }}-docker.pkg.dev' - - name: Docker configuration - run: |- - echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://$GAR_LOCATION-docker.pkg.dev - # Get the GKE credentials so we can deploy to the cluster - - name: Set up GKE credentials - uses: google-github-actions/get-gke-credentials@v0 - with: - cluster_name: ${{ env.GKE_CLUSTER }} - location: ${{ env.GKE_ZONE }} + # Get the GKE credentials so we can deploy to the cluster + - name: 'Set up GKE credentials' + uses: 'google-github-actions/get-gke-credentials@6051de21ad50fbb1767bc93c11357a49082ad116' # google-github-actions/get-gke-credentials@v2 + with: + cluster_name: '${{ env.GKE_CLUSTER }}' + location: '${{ env.GKE_ZONE }}' - # Build the Docker image - - name: Build - run: |- - docker build \ - --tag "$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA" \ - --build-arg GITHUB_SHA="$GITHUB_SHA" \ - --build-arg GITHUB_REF="$GITHUB_REF" \ - . - # Push the Docker image to Google Artifact Registry - - name: Publish - run: |- - docker push "$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA" - # Set up kustomize - - name: Set up Kustomize - run: |- - curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64 - chmod u+x ./kustomize - # Deploy the Docker image to the GKE cluster - - name: Deploy - run: |- - # replacing the image name in the k8s template - ./kustomize edit set image LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG=$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA - ./kustomize build . | kubectl apply -f - - kubectl rollout status deployment/$DEPLOYMENT_NAME - kubectl get services -o wide + # Build the Docker image + - name: 'Build and push Docker container' + run: |- + DOCKER_TAG="${GAR_LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPOSITORY}/${IMAGE}:${GITHUB_SHA}" + + docker build \ + --tag "${DOCKER_TAG}" \ + --build-arg GITHUB_SHA="${GITHUB_SHA}" \ + --build-arg GITHUB_REF="${GITHUB_REF}" \ + . + + docker push "${DOCKER_TAG}" + + # Set up kustomize + - name: 'Set up Kustomize' + run: |- + curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.4.3/kustomize_v5.4.3_linux_amd64.tar.gz + chmod u+x ./kustomize + + # Deploy the Docker image to the GKE cluster + - name: 'Deploy to GKE' + run: |- + # replacing the image name in the k8s template + ./kustomize edit set image LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY/IMAGE:TAG=$GAR_LOCATION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE:$GITHUB_SHA + ./kustomize build . | kubectl apply -f - + kubectl rollout status deployment/$DEPLOYMENT_NAME + kubectl get services -o wide From 6ac176a96e50b319149785b0bf59c1c9c1116933 Mon Sep 17 00:00:00 2001 From: Chad Bentz <1760475+felickz@users.noreply.github.com> Date: Fri, 23 Aug 2024 10:49:57 -0400 Subject: [PATCH 14/29] CodeQL - Add unique name vs default setup --- code-scanning/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 3e48389..7e46549 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -9,7 +9,7 @@ # the `language` matrix defined below to confirm you have the correct set of # supported CodeQL languages. # -name: "CodeQL" +name: "CodeQL Advanced" on: push: From bc709b6e00fad0ad44efb7d35eaa31778a651c41 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Wed, 4 Sep 2024 17:08:14 -0400 Subject: [PATCH 15/29] python-publish: bump commit/ref Signed-off-by: William Woodruff --- ci/python-publish.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 72fdda2..710ca30 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -67,5 +67,4 @@ jobs: - name: Publish release distributions to PyPI # To automatically get updates, change this to: # uses: pypa/gh-action-pypi-publish@release/v1 - uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0 - + uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1 From 9db23a2437ff17f6ad52e8b92dfc8197ed8314dd Mon Sep 17 00:00:00 2001 From: ginilpg Date: Tue, 10 Sep 2024 20:11:53 +0530 Subject: [PATCH 16/29] Add Appknox starter workflow (#2447) * Added appknox.yml for code scanning * Create appknox.json * Create appknox.svg * Update appknox.json * Update appknox.svg * Rename appknox.json to appknox.properties.json * Update appknox.yml * Update appknox.yml * Update appknox.properties.json * Formatting yml --- code-scanning/appknox.yml | 56 +++++++++++++++++++ .../properties/appknox.properties.json | 23 ++++++++ icons/appknox.svg | 10 ++++ 3 files changed, 89 insertions(+) create mode 100644 code-scanning/appknox.yml create mode 100644 code-scanning/properties/appknox.properties.json create mode 100644 icons/appknox.svg diff --git a/code-scanning/appknox.yml b/code-scanning/appknox.yml new file mode 100644 index 0000000..0282b6c --- /dev/null +++ b/code-scanning/appknox.yml @@ -0,0 +1,56 @@ +# This workflow uses actions that are not certified by GitHub. They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support documentation. +# +# Appknox: Leader in Mobile Application Security Testing Solutions +# +# To use this workflow, you must be an existing Appknox customer with GitHub Advanced Security (GHAS) enabled for your +# repository. +# +# If you *are not* an existing customer, click here to contact us for licensing and pricing details: +# . +# +# Instructions: +# +# 1. In your repository settings, navigate to 'Secrets' and click on 'New repository secret.' Name the +# secret APPKNOX_ACCESS_TOKEN and paste your appknox user token into the value field. If you don't have a appknox token +# or need to generate a new one for GitHub, visit the Appknox Platform, go to Account Settings->Developer Settings +# and create a token labeled GitHub +# +# 2. Refer to the detailed workflow below, make any required adjustments, and then save it to your repository. After the +# action executes, check the 'Security' tab for results + +name: Appknox + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] +jobs: + appknox: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + - name: Set up JDK 1.8 + uses: actions/setup-java@v1 + with: + java-version: 1.8 + - name: Grant execute permission for gradlew + run: chmod +x gradlew + + - name: Build the app + run: ./gradlew build # Update this to build your Android or iOS application + + - name: Appknox GitHub action + uses: appknox/appknox-github-action@b7d2bfb2321d5544e97bffcba48557234ab953a4 + with: + appknox_access_token: ${{ secrets.APPKNOX_ACCESS_TOKEN }} + file_path: app/build/outputs/apk/debug/app-debug.apk # Specify the path to your .ipa or .apk here + risk_threshold: MEDIUM # Update this to desired risk threshold [LOW, MEDIUM, HIGH, CRITICAL] + sarif: Enable + + - name: Upload SARIF to GHAS + if: always() + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: report.sarif diff --git a/code-scanning/properties/appknox.properties.json b/code-scanning/properties/appknox.properties.json new file mode 100644 index 0000000..4164291 --- /dev/null +++ b/code-scanning/properties/appknox.properties.json @@ -0,0 +1,23 @@ +{ + "name": "Appknox", + "creator": "Appknox", + "description": "Use Appknox action for faster and precise security assessments of your iOS and Android apps developed using any programming language", + "iconName": "appknox", + "categories": [ + "Code Scanning", + "Java", + "Kotlin", + "Scala", + "Swift", + "Objective C", + "C", + "C++", + "C#", + "Rust", + "JavaScript", + "TypeScript", + "Node" + ], + "labels": ["preview"] + +} diff --git a/icons/appknox.svg b/icons/appknox.svg new file mode 100644 index 0000000..36148e7 --- /dev/null +++ b/icons/appknox.svg @@ -0,0 +1,10 @@ + + + + + + + + + + From 53980cb868e646a5e8c7881a33599f3287729eb7 Mon Sep 17 00:00:00 2001 From: Andrew Eisenberg Date: Tue, 10 Sep 2024 11:10:00 -0700 Subject: [PATCH 17/29] Update eslint.yml Ensure suppressed warnings don't make it into the SARIF. --- code-scanning/eslint.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/code-scanning/eslint.yml b/code-scanning/eslint.yml index 7304e83..4c34d46 100644 --- a/code-scanning/eslint.yml +++ b/code-scanning/eslint.yml @@ -36,6 +36,8 @@ jobs: npm install @microsoft/eslint-formatter-sarif@2.1.7 - name: Run ESLint + env: + SARIF_ESLINT_IGNORE_SUPPRESSED: "true" run: npx eslint . --config .eslintrc.js --ext .js,.jsx,.ts,.tsx @@ -47,4 +49,4 @@ jobs: uses: github/codeql-action/upload-sarif@v3 with: sarif_file: eslint-results.sarif - wait-for-processing: true \ No newline at end of file + wait-for-processing: true From ddb47be88806996b76adbe1a1cb77d51be4925d8 Mon Sep 17 00:00:00 2001 From: Andrew Eisenberg Date: Tue, 10 Sep 2024 11:46:17 -0700 Subject: [PATCH 18/29] Update appknox.yml Fix linting errors (remove whitespace). --- code-scanning/appknox.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/code-scanning/appknox.yml b/code-scanning/appknox.yml index 0282b6c..7c4b506 100644 --- a/code-scanning/appknox.yml +++ b/code-scanning/appknox.yml @@ -11,12 +11,12 @@ # # Instructions: # -# 1. In your repository settings, navigate to 'Secrets' and click on 'New repository secret.' Name the -# secret APPKNOX_ACCESS_TOKEN and paste your appknox user token into the value field. If you don't have a appknox token -# or need to generate a new one for GitHub, visit the Appknox Platform, go to Account Settings->Developer Settings +# 1. In your repository settings, navigate to 'Secrets' and click on 'New repository secret.' Name the +# secret APPKNOX_ACCESS_TOKEN and paste your appknox user token into the value field. If you don't have a appknox token +# or need to generate a new one for GitHub, visit the Appknox Platform, go to Account Settings->Developer Settings # and create a token labeled GitHub # -# 2. Refer to the detailed workflow below, make any required adjustments, and then save it to your repository. After the +# 2. Refer to the detailed workflow below, make any required adjustments, and then save it to your repository. After the # action executes, check the 'Security' tab for results name: Appknox @@ -37,10 +37,10 @@ jobs: java-version: 1.8 - name: Grant execute permission for gradlew run: chmod +x gradlew - + - name: Build the app run: ./gradlew build # Update this to build your Android or iOS application - + - name: Appknox GitHub action uses: appknox/appknox-github-action@b7d2bfb2321d5544e97bffcba48557234ab953a4 with: @@ -48,7 +48,7 @@ jobs: file_path: app/build/outputs/apk/debug/app-debug.apk # Specify the path to your .ipa or .apk here risk_threshold: MEDIUM # Update this to desired risk threshold [LOW, MEDIUM, HIGH, CRITICAL] sarif: Enable - + - name: Upload SARIF to GHAS if: always() uses: github/codeql-action/upload-sarif@v3 From 9d2ae7c02812c6bcf7c52ea07edbd40ac70515a5 Mon Sep 17 00:00:00 2001 From: Andrew Eisenberg Date: Tue, 10 Sep 2024 11:50:28 -0700 Subject: [PATCH 19/29] Update appknox.yml Fix more whitespace issues. --- code-scanning/appknox.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/appknox.yml b/code-scanning/appknox.yml index 7c4b506..15d51e0 100644 --- a/code-scanning/appknox.yml +++ b/code-scanning/appknox.yml @@ -25,7 +25,7 @@ on: push: branches: [ $default-branch, $protected-branches ] pull_request: - branches: [ $default-branch ] + branches: [ $default-branch ] jobs: appknox: runs-on: ubuntu-latest From dea60ba593828d8920e6169345ef3c469b80798d Mon Sep 17 00:00:00 2001 From: Andrew Eisenberg Date: Wed, 11 Sep 2024 11:12:06 -0700 Subject: [PATCH 20/29] Update code-scanning/eslint.yml --- code-scanning/eslint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/eslint.yml b/code-scanning/eslint.yml index 4c34d46..b0aaeb3 100644 --- a/code-scanning/eslint.yml +++ b/code-scanning/eslint.yml @@ -33,7 +33,7 @@ jobs: - name: Install ESLint run: | npm install eslint@8.10.0 - npm install @microsoft/eslint-formatter-sarif@2.1.7 + npm install @microsoft/eslint-formatter-sarif@3.1.0 - name: Run ESLint env: From 666350e29b10d665a82d5c6d1501a29e50d63c29 Mon Sep 17 00:00:00 2001 From: ginilpg Date: Wed, 18 Sep 2024 00:20:21 +0530 Subject: [PATCH 21/29] Added appknox.yml for code scanning (#2498) Create appknox.json Create appknox.svg Update appknox.json Update appknox.svg Rename appknox.json to appknox.properties.json Update appknox.yml Update appknox.yml Update appknox.properties.json Formatting yml Removed preview mode from appknox scanner Removed preview mode from appknox scanner Add Appknox starter workflow (#2447) * Added appknox.yml for code scanning * Create appknox.json * Create appknox.svg * Update appknox.json * Update appknox.svg * Rename appknox.json to appknox.properties.json * Update appknox.yml * Update appknox.yml * Update appknox.properties.json * Formatting yml removed preview mode removed preview mode precommit lint --- code-scanning/appknox.yml | 8 +++----- code-scanning/properties/appknox.properties.json | 4 +--- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/code-scanning/appknox.yml b/code-scanning/appknox.yml index 15d51e0..68e4672 100644 --- a/code-scanning/appknox.yml +++ b/code-scanning/appknox.yml @@ -30,11 +30,9 @@ jobs: appknox: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 - - name: Set up JDK 1.8 - uses: actions/setup-java@v1 - with: - java-version: 1.8 + - name: Checkout Code + uses: actions/checkout@v2 + - name: Grant execute permission for gradlew run: chmod +x gradlew diff --git a/code-scanning/properties/appknox.properties.json b/code-scanning/properties/appknox.properties.json index 4164291..8e8b1f2 100644 --- a/code-scanning/properties/appknox.properties.json +++ b/code-scanning/properties/appknox.properties.json @@ -17,7 +17,5 @@ "JavaScript", "TypeScript", "Node" - ], - "labels": ["preview"] - + ] } From 09fa3b9723362634eb5877b2dd60fb884cb1f341 Mon Sep 17 00:00:00 2001 From: Ilya Khivrich Date: Mon, 21 Oct 2024 23:01:52 +0300 Subject: [PATCH 22/29] add jfrog-sast flow --- code-scanning/jfrog-sast.yml | 54 +++++++++++++++++++ .../properties/jfrog-sast.properties.json | 15 ++++++ 2 files changed, 69 insertions(+) create mode 100644 code-scanning/jfrog-sast.yml create mode 100644 code-scanning/properties/jfrog-sast.properties.json diff --git a/code-scanning/jfrog-sast.yml b/code-scanning/jfrog-sast.yml new file mode 100644 index 0000000..aba617d --- /dev/null +++ b/code-scanning/jfrog-sast.yml @@ -0,0 +1,54 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# JFrog SAST performs 1st party source code security analysis +# For more information, see +# https://docs.jfrog-applications.jfrog.io/jfrog-security-features/sast + +name: "JFrog SAST Scan" + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch, $protected-branches ] + schedule: + - cron: $cron-weekly + +env: + # [Mandatory] + # JFrog platform URL and access token for + # a JFrog platform instance with active + # JFrog Advanced Security subscription + JF_URL: ${{ secrets.JF_URL }} + JF_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + + - name: Install and configure JFrog CLI + run: | + npm install -g jfrog-cli-v2-jf + jf c add --interactive=false --url=$JF_URL --access-token=$JF_TOKEN + + - name: Run JFrog SAST + run: | + jf audit --sast --format=sarif > jfrog_sast.sarif + + + - name: Upload output to generate autofix + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: jfrog_sast.sarif \ No newline at end of file diff --git a/code-scanning/properties/jfrog-sast.properties.json b/code-scanning/properties/jfrog-sast.properties.json new file mode 100644 index 0000000..093d9c2 --- /dev/null +++ b/code-scanning/properties/jfrog-sast.properties.json @@ -0,0 +1,15 @@ +{ + "name": "JFrog SAST", + "description": "Scan for security vulnerabilities in source code using JFrog SAST", + "iconName": "frogbot", + "categories": + [ + "Code Scanning", + "python", + "java", + "javascript", + "typescript", + "go" + ], + "creator": "JFrog" +} \ No newline at end of file From 7f50c702183846c848e2eb13df950a942ffd2374 Mon Sep 17 00:00:00 2001 From: Ilya Khivrich Date: Tue, 22 Oct 2024 11:53:35 +0300 Subject: [PATCH 23/29] pass token over stdin, add security to properties --- code-scanning/jfrog-sast.yml | 2 +- code-scanning/properties/jfrog-sast.properties.json | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/code-scanning/jfrog-sast.yml b/code-scanning/jfrog-sast.yml index aba617d..4ff7ef7 100644 --- a/code-scanning/jfrog-sast.yml +++ b/code-scanning/jfrog-sast.yml @@ -41,7 +41,7 @@ jobs: - name: Install and configure JFrog CLI run: | npm install -g jfrog-cli-v2-jf - jf c add --interactive=false --url=$JF_URL --access-token=$JF_TOKEN + echo $JF_TOKEN | jf c add --interactive=false --url=$JF_URL --access-token-stdin - name: Run JFrog SAST run: | diff --git a/code-scanning/properties/jfrog-sast.properties.json b/code-scanning/properties/jfrog-sast.properties.json index 093d9c2..7ffa897 100644 --- a/code-scanning/properties/jfrog-sast.properties.json +++ b/code-scanning/properties/jfrog-sast.properties.json @@ -5,6 +5,7 @@ "categories": [ "Code Scanning", + "security", "python", "java", "javascript", From 958eb203602c8c9a416f802e8464a0ce75b708fe Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 5 Nov 2024 12:50:41 -0500 Subject: [PATCH 24/29] Update ci/python-publish.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sviatoslav Sydorenko (Святослав Сидоренко) --- ci/python-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 710ca30..0f5c53e 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -67,4 +67,4 @@ jobs: - name: Publish release distributions to PyPI # To automatically get updates, change this to: # uses: pypa/gh-action-pypi-publish@release/v1 - uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1 + uses: pypa/gh-action-pypi-publish@fb13cb306901256ace3dab689990e13a5550ffaa # v1.11.0 From 347784759f1270562584b69837c487fae1da0949 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Wed, 6 Nov 2024 17:10:48 -0500 Subject: [PATCH 25/29] Update ci/python-publish.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sviatoslav Sydorenko (Святослав Сидоренко) --- ci/python-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 0f5c53e..43158c6 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -67,4 +67,4 @@ jobs: - name: Publish release distributions to PyPI # To automatically get updates, change this to: # uses: pypa/gh-action-pypi-publish@release/v1 - uses: pypa/gh-action-pypi-publish@fb13cb306901256ace3dab689990e13a5550ffaa # v1.11.0 + uses: pypa/gh-action-pypi-publish@1f5d4ec244f65dce93685ee3e98e77123f090866 # v1.12.1 From eb329790015fca7ee48f8b77ed44deb431544f23 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Wed, 6 Nov 2024 21:03:35 -0500 Subject: [PATCH 26/29] Update ci/python-publish.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Sviatoslav Sydorenko (Святослав Сидоренко) --- ci/python-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 43158c6..107d347 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -67,4 +67,4 @@ jobs: - name: Publish release distributions to PyPI # To automatically get updates, change this to: # uses: pypa/gh-action-pypi-publish@release/v1 - uses: pypa/gh-action-pypi-publish@1f5d4ec244f65dce93685ee3e98e77123f090866 # v1.12.1 + uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2 From eee067e3cabfb03efe484a8dbbbed3cc5bd2130f Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Fri, 22 Nov 2024 09:47:32 -0500 Subject: [PATCH 27/29] Apply suggestions from code review Co-authored-by: Zach Steindler --- ci/python-publish.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 107d347..3feb225 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -68,3 +68,5 @@ jobs: # To automatically get updates, change this to: # uses: pypa/gh-action-pypi-publish@release/v1 uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2 + with: + packages-dir: dist/ From 00795b7feebceed43fe2510ccb976238441d9c07 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Fri, 22 Nov 2024 09:48:05 -0500 Subject: [PATCH 28/29] Apply suggestions from code review --- ci/python-publish.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ci/python-publish.yml b/ci/python-publish.yml index 3feb225..82f8dbd 100644 --- a/ci/python-publish.yml +++ b/ci/python-publish.yml @@ -65,8 +65,6 @@ jobs: path: dist/ - name: Publish release distributions to PyPI - # To automatically get updates, change this to: - # uses: pypa/gh-action-pypi-publish@release/v1 - uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2 + uses: pypa/gh-action-pypi-publish@release/v1 with: packages-dir: dist/ From f90b59f7cd6c78cb77ba8274dd8b01499074948b Mon Sep 17 00:00:00 2001 From: Rob E Date: Sat, 14 Dec 2024 02:54:28 +1000 Subject: [PATCH 29/29] Add Octopus Deploy release and deploy workflow (#2651) * Create Octopus Deploy workflow template * add properties file * Pin step versions * update some text * add octopus icon * added linebreak Co-authored-by: Alexis Abril * added linebreak Co-authored-by: Alexis Abril * update octopusdeploy icon name --------- Co-authored-by: Alexis Abril --- deployments/octopusdeploy.yml | 112 ++++++++++++++++++ .../properties/octopusdeploy.properties.json | 7 ++ icons/octopusdeploy.svg | 11 ++ 3 files changed, 130 insertions(+) create mode 100644 deployments/octopusdeploy.yml create mode 100644 deployments/properties/octopusdeploy.properties.json create mode 100644 icons/octopusdeploy.svg diff --git a/deployments/octopusdeploy.yml b/deployments/octopusdeploy.yml new file mode 100644 index 0000000..cc1f2f4 --- /dev/null +++ b/deployments/octopusdeploy.yml @@ -0,0 +1,112 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by separate terms of service, +# privacy policy, and support documentation. +# +# This workflow will build and publish a Docker container which is then deployed through Octopus Deploy. +# +# The build job in this workflow currently assumes that there is a Dockerfile that generates the relevant application image. +# If required, this job can be modified to generate whatever alternative build artifact is required for your deployment. +# +# This workflow assumes you have already created a Project in Octopus Deploy. +# For instructions see https://octopus.com/docs/projects/setting-up-projects +# +# To configure this workflow: +# +# 1. Decide where you are going to host your image. +# This template uses the GitHub Registry for simplicity but if required you can update the relevant DOCKER_REGISTRY variables below. +# +# 2. Create and configure an OIDC credential for a service account in Octopus. +# This allows for passwordless authentication to your Octopus instance through a trust relationship configured between Octopus, GitHub and your GitHub Repository. +# https://octopus.com/docs/octopus-rest-api/openid-connect/github-actions +# +# 3. Configure your Octopus project details below: +# OCTOPUS_URL: update to your Octopus Instance Url +# OCTOPUS_SERVICE_ACCOUNT: update to your service account Id +# OCTOPUS_SPACE: update to the name of the space your project is configured in +# OCTOPUS_PROJECT: update to the name of your Octopus project +# OCTOPUS_ENVIRONMENT: update to the name of the environment to recieve the first deployment + + +name: 'Build and Deploy to Octopus Deploy' + +on: + push: + branches: + - '$default-branch' + +jobs: + build: + name: Build + runs-on: ubuntu-latest + permissions: + packages: write + contents: read + env: + DOCKER_REGISTRY: ghcr.io # TODO: Update to your docker registry uri + DOCKER_REGISTRY_USERNAME: ${{ github.actor }} # TODO: Update to your docker registry username + DOCKER_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} # TODO: Update to your docker registry password + outputs: + image_tag: ${{ steps.meta.outputs.version }} + steps: + - uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 + + - name: Log in to the Container registry + uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1 + with: + registry: ${{ env.DOCKER_REGISTRY }} + username: ${{ env.DOCKER_REGISTRY_USERNAME }} + password: ${{ env.DOCKER_REGISTRY_PASSWORD }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 + with: + images: ${{ env.DOCKER_REGISTRY }}/${{ github.repository }} + tags: type=semver,pattern={{version}},value=v1.0.0-{{sha}} + + - name: Build and push Docker image + id: push + uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + deploy: + name: Deploy + permissions: + id-token: write + runs-on: ubuntu-latest + needs: [ build ] + env: + OCTOPUS_URL: 'https://your-octopus-url' # TODO: update to your Octopus Instance url + OCTOPUS_SERVICE_ACCOUNT: 'your-service-account-id' # TODO: update to your service account Id + OCTOPUS_SPACE: 'your-space' # TODO: update to the name of the space your project is configured in + OCTOPUS_PROJECT: 'your-project' # TODO: update to the name of your Octopus project + OCTOPUS_ENVIRONMENT: 'your-environment' # TODO: update to the name of the environment to recieve the first deployment + + steps: + - name: Login to Octopus Deploy + uses: OctopusDeploy/login@34b6dcc1e86fa373c14e6a28c5507d221e4de629 #v1.0.2 + with: + server: '${{ env.OCTOPUS_URL }}' + service_account_id: '${{ env.OCTOPUS_SERVICE_ACCOUNT }}' + + - name: Create Release + id: create_release + uses: OctopusDeploy/create-release-action@fea7e7b45c38c021b6bc5a14bd7eaa2ed5269214 #v3.2.2 + with: + project: '${{ env.OCTOPUS_PROJECT }}' + space: '${{ env.OCTOPUS_SPACE }}' + packages: '*:${{ needs.build.outputs.image_tag }}' + + - name: Deploy Release + uses: OctopusDeploy/deploy-release-action@b10a606c903b0a5bce24102af9d066638ab429ac #v3.2.1 + with: + project: '${{ env.OCTOPUS_PROJECT }}' + space: '${{ env.OCTOPUS_SPACE }}' + release_number: '${{ steps.create_release.outputs.release_number }}' + environments: ${{ env.OCTOPUS_ENVIRONMENT }} diff --git a/deployments/properties/octopusdeploy.properties.json b/deployments/properties/octopusdeploy.properties.json new file mode 100644 index 0000000..3743ea7 --- /dev/null +++ b/deployments/properties/octopusdeploy.properties.json @@ -0,0 +1,7 @@ +{ + "name": "Build and Deploy with Octopus Deploy", + "description": "Build a docker container, create a release in Octopus Deploy and deploy it to your environment.", + "creator": "Octopus Deploy", + "iconName": "octopusdeploy", + "categories": ["Deployment", "Containers", "Dockerfile"] +} diff --git a/icons/octopusdeploy.svg b/icons/octopusdeploy.svg new file mode 100644 index 0000000..28545cc --- /dev/null +++ b/icons/octopusdeploy.svg @@ -0,0 +1,11 @@ + + + + +