From eeb84c9ae6f1844ca670440d5e8259830defcdfd Mon Sep 17 00:00:00 2001 From: Abir Majumdar Date: Thu, 28 Oct 2021 10:55:20 -0400 Subject: [PATCH 1/6] Adding Psalm PHP scanning to Starter Workflows --- .../properties/psalm.properties.json | 10 +++++++ code-scanning/psalm.yml | 30 +++++++++++++++++++ icons/psalm.svg | 23 ++++++++++++++ 3 files changed, 63 insertions(+) create mode 100644 code-scanning/properties/psalm.properties.json create mode 100644 code-scanning/psalm.yml create mode 100644 icons/psalm.svg diff --git a/code-scanning/properties/psalm.properties.json b/code-scanning/properties/psalm.properties.json new file mode 100644 index 0000000..711fd39 --- /dev/null +++ b/code-scanning/properties/psalm.properties.json @@ -0,0 +1,10 @@ +{ + "name": "Psalm Security Scan", + "creator": "psalm", + "description": "Psalm is a static analysis tool for finding errors in PHP applications", + "iconName": "mobsf", + "categories": [ + "Code Scanning", + "PHP" + ] +} \ No newline at end of file diff --git a/code-scanning/psalm.yml b/code-scanning/psalm.yml new file mode 100644 index 0000000..b4c7aba --- /dev/null +++ b/code-scanning/psalm.yml @@ -0,0 +1,30 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Psalm Security Scan + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +jobs: + php-security: + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v2 + + - name: Psalm Security Scan + uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 + + - name: Upload Security Analysis results to GitHub + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif \ No newline at end of file diff --git a/icons/psalm.svg b/icons/psalm.svg new file mode 100644 index 0000000..3533e2d --- /dev/null +++ b/icons/psalm.svg @@ -0,0 +1,23 @@ + + + + + + + + + + + + + + + + + + + + + + + From ec35be8871f419348e0b448a3a5a5e2987287522 Mon Sep 17 00:00:00 2001 From: Abir Majumdar <83433840+abirismyname@users.noreply.github.com> Date: Wed, 10 Nov 2021 11:31:39 -0500 Subject: [PATCH 2/6] Update psalm.properties.json --- code-scanning/properties/psalm.properties.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/code-scanning/properties/psalm.properties.json b/code-scanning/properties/psalm.properties.json index 711fd39..cba67b4 100644 --- a/code-scanning/properties/psalm.properties.json +++ b/code-scanning/properties/psalm.properties.json @@ -2,9 +2,9 @@ "name": "Psalm Security Scan", "creator": "psalm", "description": "Psalm is a static analysis tool for finding errors in PHP applications", - "iconName": "mobsf", + "iconName": "psalm", "categories": [ "Code Scanning", "PHP" ] -} \ No newline at end of file +} From f35be5c494bbd11675293a19c91e471191d9d66d Mon Sep 17 00:00:00 2001 From: Emmanuel Roullit Date: Fri, 27 Jan 2023 13:58:39 +0100 Subject: [PATCH 3/6] icon: refresh psalm logo Signed-off-by: Emmanuel Roullit --- icons/psalm.svg | 24 +----------------------- 1 file changed, 1 insertion(+), 23 deletions(-) diff --git a/icons/psalm.svg b/icons/psalm.svg index 3533e2d..fd9d347 100644 --- a/icons/psalm.svg +++ b/icons/psalm.svg @@ -1,23 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file From ac13a846c956442df592a674cac09e7208c1ed3e Mon Sep 17 00:00:00 2001 From: Emmanuel Roullit Date: Fri, 27 Jan 2023 14:04:26 +0100 Subject: [PATCH 4/6] ci: remove trailing whitespaces Signed-off-by: Emmanuel Roullit --- code-scanning/properties/psalm.properties.json | 2 +- code-scanning/psalm.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/code-scanning/properties/psalm.properties.json b/code-scanning/properties/psalm.properties.json index cba67b4..381a312 100644 --- a/code-scanning/properties/psalm.properties.json +++ b/code-scanning/properties/psalm.properties.json @@ -4,7 +4,7 @@ "description": "Psalm is a static analysis tool for finding errors in PHP applications", "iconName": "psalm", "categories": [ - "Code Scanning", + "Code Scanning", "PHP" ] } diff --git a/code-scanning/psalm.yml b/code-scanning/psalm.yml index b4c7aba..d6226a1 100644 --- a/code-scanning/psalm.yml +++ b/code-scanning/psalm.yml @@ -9,21 +9,21 @@ on: push: branches: [ $default-branch, $protected-branches ] pull_request: - branches: [ $default-branch ] + branches: [ $default-branch ] schedule: - cron: $cron-weekly jobs: php-security: runs-on: ubuntu-latest - + steps: - name: Checkout code uses: actions/checkout@v2 - name: Psalm Security Scan uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 - + - name: Upload Security Analysis results to GitHub uses: github/codeql-action/upload-sarif@v1 with: From f07709949e75d13e1511700953273eb80da4635c Mon Sep 17 00:00:00 2001 From: Emmanuel Roullit Date: Fri, 27 Jan 2023 14:13:04 +0100 Subject: [PATCH 5/6] ci: restrict starter workflow permissions Signed-off-by: Emmanuel Roullit --- code-scanning/psalm.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/code-scanning/psalm.yml b/code-scanning/psalm.yml index d6226a1..d35787e 100644 --- a/code-scanning/psalm.yml +++ b/code-scanning/psalm.yml @@ -9,13 +9,21 @@ on: push: branches: [ $default-branch, $protected-branches ] pull_request: + # The branches below must be a subset of the branches above branches: [ $default-branch ] schedule: - cron: $cron-weekly +permissions: + contents: read + jobs: php-security: runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status steps: - name: Checkout code @@ -27,4 +35,4 @@ jobs: - name: Upload Security Analysis results to GitHub uses: github/codeql-action/upload-sarif@v1 with: - sarif_file: results.sarif \ No newline at end of file + sarif_file: results.sarif From 3a818c491024917b28e503cbac0e1aa1d07a8fbd Mon Sep 17 00:00:00 2001 From: Emmanuel Roullit Date: Fri, 27 Jan 2023 14:13:37 +0100 Subject: [PATCH 6/6] ci: bump github actions version Signed-off-by: Emmanuel Roullit --- code-scanning/psalm.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/code-scanning/psalm.yml b/code-scanning/psalm.yml index d35787e..1e88766 100644 --- a/code-scanning/psalm.yml +++ b/code-scanning/psalm.yml @@ -27,12 +27,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@v3 - name: Psalm Security Scan uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287 - name: Upload Security Analysis results to GitHub - uses: github/codeql-action/upload-sarif@v1 + uses: github/codeql-action/upload-sarif@v2 with: sarif_file: results.sarif