From 25f4fd1b5fec908829d2da20f4009f1d8074ef12 Mon Sep 17 00:00:00 2001 From: Mattias Cibien Date: Wed, 27 Oct 2021 16:24:24 +0200 Subject: [PATCH 01/23] Fix dotnet-desktop template Removed environment variable which is not currently used and makes the build fail --- ci/dotnet-desktop.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/dotnet-desktop.yml b/ci/dotnet-desktop.yml index 0635779..c22b998 100644 --- a/ci/dotnet-desktop.yml +++ b/ci/dotnet-desktop.yml @@ -105,7 +105,7 @@ jobs: # Remove the pfx - name: Remove the pfx - run: Remove-Item -path $env:Wap_Project_Directory\$env:Signing_Certificate + run: Remove-Item -path $env:Wap_Project_Directory\GitHubActionsWorkflow.pfx # Upload the MSIX package: https://github.com/marketplace/actions/upload-a-build-artifact - name: Upload build artifacts From 394301af94ed4c4a052d067ef69a71885bc0a297 Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Mon, 14 Feb 2022 10:11:33 +0000 Subject: [PATCH 02/23] Adding folder category check --- script/validate-data/index.ts | 17 ++++++++++++----- script/validate-data/settings.json | 18 ++++++++++++++++++ 2 files changed, 30 insertions(+), 5 deletions(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index 7dce3d1..6669b34 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -1,7 +1,7 @@ #!/usr/bin/env npx ts-node import { promises as fs } from "fs"; import { safeLoad } from "js-yaml"; -import { basename, extname, join } from "path"; +import { basename, extname, join, dirname } from "path"; import { Validator as validator } from "jsonschema"; import { endGroup, error, info, setFailed, startGroup } from '@actions/core'; @@ -40,7 +40,7 @@ const propertiesSchema = { } } -async function checkWorkflows(folders: string[], allowed_categories: string[]): Promise { +async function checkWorkflows(folders: string[], allowed_categories: string[], folder_category_map: object[]): Promise { const result: WorkflowWithErrors[] = [] const workflow_template_names = new Set() for (const folder of folders) { @@ -55,7 +55,7 @@ async function checkWorkflows(folders: string[], allowed_categories: string[]): const workflowFilePath = join(folder, e.name); const propertiesFilePath = join(folder, "properties", `${fileType}.properties.json`) - const workflowWithErrors = await checkWorkflow(workflowFilePath, propertiesFilePath, allowed_categories); + const workflowWithErrors = await checkWorkflow(workflowFilePath, propertiesFilePath, allowed_categories, folder_category_map); if(workflowWithErrors.name && workflow_template_names.size == workflow_template_names.add(workflowWithErrors.name).size) { workflowWithErrors.errors.push(`Workflow template name "${workflowWithErrors.name}" already exists`) } @@ -69,7 +69,7 @@ async function checkWorkflows(folders: string[], allowed_categories: string[]): return result; } -async function checkWorkflow(workflowPath: string, propertiesPath: string, allowed_categories: string[]): Promise { +async function checkWorkflow(workflowPath: string, propertiesPath: string, allowed_categories: string[], folder_category_map: object[]): Promise { let workflowErrors: WorkflowWithErrors = { id: workflowPath, name: null, @@ -104,10 +104,17 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow } } + var directoryName = dirname(workflowPath) + var folder_category = folder_category_map.find( folder_category => folder_category["name"] == directoryName)["category"] if (!workflowPath.endsWith("blank.yml") && (!properties.categories || !properties.categories.some(category => allowed_categories.some(ac => ac.toLowerCase() == category.toLowerCase())))) { workflowErrors.errors.push(`Workflow does not contain at least one allowed category - ${allowed_categories}`) } + + if(properties.categories && !properties.categories.some(category => category.toLowerCase() == folder_category.toLowerCase())) { + workflowErrors.errors.push(`Either workflow is not added to the correct directory or category specified is wrong. Allowed category for ${basename(directoryName)} directory is ${folder_category}`) + } + } catch (e) { workflowErrors.errors.push(e.toString()) } @@ -118,7 +125,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow try { const settings = require("./settings.json"); const erroredWorkflows = await checkWorkflows( - settings.folders, settings.allowed_categories + settings.folders, settings.allowed_categories, settings.folder_category_map ) if (erroredWorkflows.length > 0) { diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json index ce89e36..ab1ada3 100644 --- a/script/validate-data/settings.json +++ b/script/validate-data/settings.json @@ -10,5 +10,23 @@ "Deployment", "Code Scanning", "Automation" + ], + "folder_category_map": [ + { + "name": "../../ci", + "category": "Continuous integration" + }, + { + "name": "../../automation", + "category": "Automation" + }, + { + "name": "../../deployments", + "category": "Deployment" + }, + { + "name": "../../code-scanning", + "category": "Code Scanning" + } ] } \ No newline at end of file From aafd23c138797490f77148df749cb66c609c825a Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Thu, 24 Feb 2022 10:26:04 +0000 Subject: [PATCH 03/23] review comments --- script/validate-data/index.ts | 21 ++++++++++----------- script/validate-data/settings.json | 8 +------- 2 files changed, 11 insertions(+), 18 deletions(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index 6669b34..c3b6fa9 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -69,7 +69,7 @@ async function checkWorkflows(folders: string[], allowed_categories: string[], f return result; } -async function checkWorkflow(workflowPath: string, propertiesPath: string, allowed_categories: string[], folder_category_map: object[]): Promise { +async function checkWorkflow(workflowPath: string, propertiesPath: string, allowed_categories: string[], directory_category_map: object[]): Promise { let workflowErrors: WorkflowWithErrors = { id: workflowPath, name: null, @@ -105,16 +105,15 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow } var directoryName = dirname(workflowPath) - var folder_category = folder_category_map.find( folder_category => folder_category["name"] == directoryName)["category"] - if (!workflowPath.endsWith("blank.yml") && (!properties.categories || - !properties.categories.some(category => allowed_categories.some(ac => ac.toLowerCase() == category.toLowerCase())))) { - workflowErrors.errors.push(`Workflow does not contain at least one allowed category - ${allowed_categories}`) + var directory_category = directory_category_map.find( folder_category => folder_category["name"] == directoryName)["category"] + if (!workflowPath.endsWith("blank.yml") && ((!properties.categories || properties.categories.length == 0 )|| + properties.categories[0].toLowerCase() !== directory_category.toLowerCase())) { + if(!properties.categories || properties.categories.length == 0) { + workflowErrors.errors.push(`Workflow categories cannot be null or empty`) + } else { + workflowErrors.errors.push(`The first category in properties.json categories must be "${directory_category}" for ${basename(directoryName)} directory workflow.`) + } } - - if(properties.categories && !properties.categories.some(category => category.toLowerCase() == folder_category.toLowerCase())) { - workflowErrors.errors.push(`Either workflow is not added to the correct directory or category specified is wrong. Allowed category for ${basename(directoryName)} directory is ${folder_category}`) - } - } catch (e) { workflowErrors.errors.push(e.toString()) } @@ -125,7 +124,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow try { const settings = require("./settings.json"); const erroredWorkflows = await checkWorkflows( - settings.folders, settings.allowed_categories, settings.folder_category_map + settings.folders, settings.allowed_categories, settings.directory_category_map ) if (erroredWorkflows.length > 0) { diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json index ab1ada3..2dd3898 100644 --- a/script/validate-data/settings.json +++ b/script/validate-data/settings.json @@ -5,13 +5,7 @@ "../../deployments", "../../code-scanning" ], - "allowed_categories" : [ - "Continuous integration", - "Deployment", - "Code Scanning", - "Automation" - ], - "folder_category_map": [ + "directory_category_map": [ { "name": "../../ci", "category": "Continuous integration" From ac7b3362da33824992eea1a04c15dccb84799abe Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Fri, 4 Mar 2022 05:59:55 +0000 Subject: [PATCH 04/23] removing unused variables --- script/validate-data/index.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index c3b6fa9..e54b6c1 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -40,7 +40,7 @@ const propertiesSchema = { } } -async function checkWorkflows(folders: string[], allowed_categories: string[], folder_category_map: object[]): Promise { +async function checkWorkflows(folders: string[], folder_category_map: object[]): Promise { const result: WorkflowWithErrors[] = [] const workflow_template_names = new Set() for (const folder of folders) { @@ -55,7 +55,7 @@ async function checkWorkflows(folders: string[], allowed_categories: string[], f const workflowFilePath = join(folder, e.name); const propertiesFilePath = join(folder, "properties", `${fileType}.properties.json`) - const workflowWithErrors = await checkWorkflow(workflowFilePath, propertiesFilePath, allowed_categories, folder_category_map); + const workflowWithErrors = await checkWorkflow(workflowFilePath, propertiesFilePath, folder_category_map); if(workflowWithErrors.name && workflow_template_names.size == workflow_template_names.add(workflowWithErrors.name).size) { workflowWithErrors.errors.push(`Workflow template name "${workflowWithErrors.name}" already exists`) } @@ -69,7 +69,7 @@ async function checkWorkflows(folders: string[], allowed_categories: string[], f return result; } -async function checkWorkflow(workflowPath: string, propertiesPath: string, allowed_categories: string[], directory_category_map: object[]): Promise { +async function checkWorkflow(workflowPath: string, propertiesPath: string, directory_category_map: object[]): Promise { let workflowErrors: WorkflowWithErrors = { id: workflowPath, name: null, @@ -124,7 +124,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow try { const settings = require("./settings.json"); const erroredWorkflows = await checkWorkflows( - settings.folders, settings.allowed_categories, settings.directory_category_map + settings.folders, settings.directory_category_map ) if (erroredWorkflows.length > 0) { From c6cf518c753c35074eb20e53d641c91e6d87528d Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Fri, 4 Mar 2022 06:28:56 +0000 Subject: [PATCH 05/23] reaming directory to folder and added creator check for deployment templates --- script/validate-data/index.ts | 17 +++++++++++------ script/validate-data/settings.json | 2 +- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index e54b6c1..da4d2d8 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -14,6 +14,7 @@ interface WorkflowWithErrors { interface WorkflowProperties { name: string; description: string; + creator: string; iconName: string; categories: string[]; } @@ -69,7 +70,7 @@ async function checkWorkflows(folders: string[], folder_category_map: object[]): return result; } -async function checkWorkflow(workflowPath: string, propertiesPath: string, directory_category_map: object[]): Promise { +async function checkWorkflow(workflowPath: string, propertiesPath: string, folder_category_map: object[]): Promise { let workflowErrors: WorkflowWithErrors = { id: workflowPath, name: null, @@ -104,16 +105,20 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, direc } } - var directoryName = dirname(workflowPath) - var directory_category = directory_category_map.find( folder_category => folder_category["name"] == directoryName)["category"] + var folderName = dirname(workflowPath) + var folder_category = folder_category_map.find( folder_category => folder_category["name"] == folderName)["category"] if (!workflowPath.endsWith("blank.yml") && ((!properties.categories || properties.categories.length == 0 )|| - properties.categories[0].toLowerCase() !== directory_category.toLowerCase())) { + properties.categories[0].toLowerCase() !== folder_category.toLowerCase())) { if(!properties.categories || properties.categories.length == 0) { workflowErrors.errors.push(`Workflow categories cannot be null or empty`) } else { - workflowErrors.errors.push(`The first category in properties.json categories must be "${directory_category}" for ${basename(directoryName)} directory workflow.`) + workflowErrors.errors.push(`The first category in properties.json categories must be "${folder_category}" for ${basename(folderName)} folder workflow.`) } } + + if(folder_category.toLowerCase() == 'deployment' && !properties.creator) { + workflowErrors.errors.push(`The "creator" in properties.json must be present.`) + } } catch (e) { workflowErrors.errors.push(e.toString()) } @@ -124,7 +129,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, direc try { const settings = require("./settings.json"); const erroredWorkflows = await checkWorkflows( - settings.folders, settings.directory_category_map + settings.folders, settings.folder_category_map ) if (erroredWorkflows.length > 0) { diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json index 2dd3898..7d3ecfe 100644 --- a/script/validate-data/settings.json +++ b/script/validate-data/settings.json @@ -5,7 +5,7 @@ "../../deployments", "../../code-scanning" ], - "directory_category_map": [ + "folder_category_map": [ { "name": "../../ci", "category": "Continuous integration" From 002e1a441e4ada04aca6da6f20a4b1fd079548ed Mon Sep 17 00:00:00 2001 From: Matt Moore Date: Mon, 6 Dec 2021 12:04:44 -0800 Subject: [PATCH 06/23] Support uppercase repository names with cosign. My previous PR didn't properly handle uppercase usernames (or repository names) when signing container images with `cosign`. It seems that the `docker buildx --push` doesn't like this either, but it's passed the output of the `docker/metadata-action` which seems to lowercase things. Fixes: https://github.com/actions/starter-workflows/issues/1293 Signed-off-by: Matt Moore --- ci/docker-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/docker-publish.yml b/ci/docker-publish.yml index 977635a..ee2ec63 100644 --- a/ci/docker-publish.yml +++ b/ci/docker-publish.yml @@ -90,4 +90,4 @@ jobs: COSIGN_EXPERIMENTAL: "true" # This step uses the identity token to provision an ephemeral certificate # against the sigstore community Fulcio instance. - run: cosign sign ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }} + run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }} From bf7a4cab85f1dab83a885af2bfd3a5e85d273cd7 Mon Sep 17 00:00:00 2001 From: Jack G Kafaty <50452463+jackgkafaty@users.noreply.github.com> Date: Thu, 21 Apr 2022 13:09:39 -0400 Subject: [PATCH 07/23] Update codeql.yml Line 51 added the query packs by default but commented. Lines 62-63: added better instructions Lines 68-70 added an example which provides better detail --- code-scanning/codeql.yml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 37109ab..ded7f5d 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -48,8 +48,11 @@ jobs: # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild @@ -58,13 +61,12 @@ jobs: # ℹ️ Command-line programs to run using the OS shell. # 📚 https://git.io/JvXDl - # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines - # and modify them (or add more) to build your code if your project - # uses a compiled language + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - #- run: | - # make bootstrap - # make release + # - run: | + # echo "Run, Build Application using script" + # pwsh -command .\location_of_script_within_repo\buildscript.ps1 - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v2 From a5cb76fffb46eedc8f79cc3868b3f1868c7fe766 Mon Sep 17 00:00:00 2001 From: Jack G Kafaty <50452463+jackgkafaty@users.noreply.github.com> Date: Thu, 21 Apr 2022 13:19:45 -0400 Subject: [PATCH 08/23] Update codeql.yml --- code-scanning/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index ded7f5d..8da9bf2 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -66,7 +66,7 @@ jobs: # - run: | # echo "Run, Build Application using script" - # pwsh -command .\location_of_script_within_repo\buildscript.ps1 + # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v2 From a52cd5a16a7422970cf0d09ddd7489c0abcd1cf3 Mon Sep 17 00:00:00 2001 From: Tristram Oaten Date: Mon, 25 Apr 2022 15:02:37 +0100 Subject: [PATCH 09/23] Update setup-ruby to the latest release The default github action ruby template references this old commit which doesn't have any modern rubies https://github.com/ruby/setup-ruby/commit/473e4d8fe5dd94ee328fdfca9f8c9c7afc9dae5e The fix is to update the pinned version to the latest release https://github.com/alphagov/forms-api/pull/3/commits/e3c8ad2759088a12ba9f3040d2c47c23799c8455 --- ci/ruby.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/ruby.yml b/ci/ruby.yml index 256aa14..7daf2cc 100644 --- a/ci/ruby.yml +++ b/ci/ruby.yml @@ -30,7 +30,7 @@ jobs: # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby, # change this to (see https://github.com/ruby/setup-ruby#versioning): # uses: ruby/setup-ruby@v1 - uses: ruby/setup-ruby@473e4d8fe5dd94ee328fdfca9f8c9c7afc9dae5e + uses: ruby/setup-ruby@e3c8ad2759088a12ba9f3040d2c47c23799c8455 with: ruby-version: ${{ matrix.ruby-version }} bundler-cache: true # runs 'bundle install' and caches installed gems automatically From 0ae51b0d1063d99894068034e0f6e7de60e6ec5b Mon Sep 17 00:00:00 2001 From: Tristram Oaten Date: Thu, 28 Apr 2022 10:58:56 +0100 Subject: [PATCH 10/23] fix sha --- ci/ruby.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/ruby.yml b/ci/ruby.yml index 7daf2cc..81ea363 100644 --- a/ci/ruby.yml +++ b/ci/ruby.yml @@ -30,7 +30,7 @@ jobs: # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby, # change this to (see https://github.com/ruby/setup-ruby#versioning): # uses: ruby/setup-ruby@v1 - uses: ruby/setup-ruby@e3c8ad2759088a12ba9f3040d2c47c23799c8455 + uses: ruby/setup-ruby@2b019609e2b0f1ea1a2bc8ca11cb82ab46ada124 with: ruby-version: ${{ matrix.ruby-version }} bundler-cache: true # runs 'bundle install' and caches installed gems automatically From 662e915c0fe85c4d078b6de037bce62ebc69fe96 Mon Sep 17 00:00:00 2001 From: Bar Hofesh Date: Thu, 28 Apr 2022 22:01:20 +0300 Subject: [PATCH 11/23] Add NeuraLegion to starter workflows (#1203) * Added Neuralegion to starter workflows * Using an action * Fixed Indentation :) * Update neuralegion.yml Co-authored-by: Bishal Prasad --- code-scanning/neuralegion.yml | 175 ++++++++++++++++++ .../properties/neuralegion.properties.json | 24 +++ icons/neuralegion.svg | 57 ++++++ 3 files changed, 256 insertions(+) create mode 100644 code-scanning/neuralegion.yml create mode 100644 code-scanning/properties/neuralegion.properties.json create mode 100644 icons/neuralegion.svg diff --git a/code-scanning/neuralegion.yml b/code-scanning/neuralegion.yml new file mode 100644 index 0000000..e24e14a --- /dev/null +++ b/code-scanning/neuralegion.yml @@ -0,0 +1,175 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# Run a Nexploit Scan +# This action runs a new security scan in Nexploit, or reruns an existing one. +# Build Secure Apps & APIs. Fast. +# [NeuraLegion](https://www.neuralegion.com) is a powerful dynamic application & API security testing (DAST) platform that security teams trust and developers love. +# Automatically Tests Every Aspect of Your Apps & APIs +# Scans any target, whether Web Apps, APIs (REST. & SOAP, GraphQL & more), Web sockets or mobile, providing actionable reports +# Seamlessly integrates with the Tools and Workflows You Already Use +# +# NeuraLegion works with your existing CI/CD pipelines – trigger scans on every commit, pull request or build with unit testing. +# Spin-Up, Configure and Control Scans with Code +# One file. One command. One scan. No UI needed. +# +# Super-Fast Scans +# +# Interacts with applications and APIs, instead of just crawling them and guessing. +# Scans are fast as our AI-powered engine can understand application architecture and generate sophisticated and targeted attacks. +# +# No False Positives +# +# Stop chasing ghosts and wasting time. NeuraLegion doesn’t return false positives, so you can focus on releasing code. +# +# Comprehensive Security Testing +# +# NeuraLegion tests for all common vulnerabilities, such as SQL injection, CSRF, XSS, and XXE -- as well as uncommon vulnerabilities, such as business logic vulnerabilities. +# +# More information is available on NeuraLegion’s: +# * [Website](https://www.neuralegion.com/) +# * [Knowledge base](https://docs.neuralegion.com/docs/quickstart) +# * [YouTube channel](https://www.youtube.com/channel/UCoIC0T1pmozq3eKLsUR2uUw) +# * [GitHub Actions](https://github.com/marketplace?query=neuralegion+) +# +# Inputs +# +# `name` +# +# **Required**. Scan name. +# +# _Example:_ `name: GitHub scan ${{ github.sha }}` +# +# `api_token` +# +# **Required**. Your Nexploit API authorization token (key). You can generate it in the **Organization** section on [nexploit.app](https://nexploit.app/login). Find more information [here](https://kb.neuralegion.com/#/guide/np-web-ui/advanced-set-up/managing-org?id=managing-organization-apicli-authentication-tokens). +# +# _Example:_ `api_token: ${{ secrets.NEXPLOIT_TOKEN }}` +# +# `restart_scan` +# +# **Required** when restarting an existing scan by its ID. You can get the scan ID in the Scans section on [nexploit.app](https://nexploit.app/login).
Please make sure to only use the necessary parameters. Otherwise, you will get a response with the parameter usage requirements. +# +# _Example:_ `restart_scan: ai3LG8DmVn9Rn1YeqCNRGQ)` +# +# `discovery_types` +# +# **Required**. Array of discovery types. The following types are available: +# * `archive` - uses an uploaded HAR-file for a scan +# * `crawler` - uses a crawler to define the attack surface for a scan +# * `oas` - uses an uploaded OpenAPI schema for a scan
+# If no discovery type is specified, `crawler` is applied by default. +# +# _Example:_ +# +# ```yml +# discovery_types: | +# [ "crawler", "archive" ] +# ``` +# +# `file_id` +# +# **Required** if the discovery type is set to `archive` or `oas`. ID of a HAR-file or an OpenAPI schema you want to use for a scan. You can get the ID of an uploaded HAR-file or an OpenAPI schema in the **Storage** section on [nexploit.app](https://nexploit.app/login). +# +# _Example:_ +# +# ``` +# FILE_ID=$(nexploit-cli archive:upload \ +# --token ${{ secrets.NEXPLOIT_TOKEN }} \ +# --discard true \ +# ./example.har) +# ``` +# +# `crawler_urls` +# +# **Required** if the discovery type is set to `crawler`. Target URLs to be used by the crawler to define the attack surface. +# +# _Example:_ +# +# ``` +# crawler_urls: | +# [ "http://vulnerable-bank.com" ] +# ``` +# +# `hosts_filter` +# +# **Required** when the the discovery type is set to `archive`. Allows selecting specific hosts for a scan. +# +# Outputs +# +# `url` +# +# Url of the resulting scan +# +# `id` +# +# ID of the created scan. This ID could then be used to restart the scan, or for the following GitHub actions: +# * [Nexploit Wait for Issues](https://github.com/marketplace/actions/nexploit-wait-for-issues) +# * [Nexploit Stop Scan](https://github.com/marketplace/actions/nexploit-stop-scan) +# +# Example usage +# +# Start a new scan with parameters +# +# ```yml +# steps: +# - name: Start Nexploit Scan +# id: start +# uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe +# with: +# api_token: ${{ secrets.NEXPLOIT_TOKEN }} +# name: GitHub scan ${{ github.sha }} +# discovery_types: | +# [ "crawler", "archive" ] +# crawler_urls: | +# [ "http://vulnerable-bank.com" ] +# file_id: LiYknMYSdbSZbqgMaC9Sj +# hosts_filter: | +# [ ] +# - name: Get the output scan url +# run: echo "The scan was started on ${{ steps.start.outputs.url }}" +# ``` +# +# Restart an existing scan +# +# ```yml +# steps: +# - name: Start Nexploit Scan +# id: start +# uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe +# with: +# api_token: ${{ secrets.NEXPLOIT_TOKEN }} +# name: GitHub scan ${{ github.sha }} +# restart_scan: ai3LG8DmVn9Rn1YeqCNRGQ +# - name: Get the output scan url +# run: echo "The scan was started on ${{ steps.start.outputs.url }}" + + +name: "NeuraLegion" + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +jobs: + neuralegion_scan: + runs-on: ubuntu-18.04 + name: A job to run a Nexploit scan + steps: + - uses: actions/checkout@v2 + - name: Start Nexploit Scan 🏁 + id: start + uses: NeuraLegion/run-scan@29ebd17b4fd6292ce7a238a59401668953b37fbe + with: + api_token: ${{ secrets.NEURALEGION_TOKEN }} + name: GitHub scan ${{ github.sha }} + discovery_types: | + [ "crawler" ] + crawler_urls: | + [ "https://brokencrystals.com" ] # ✏️ Update this to the url you wish to scan diff --git a/code-scanning/properties/neuralegion.properties.json b/code-scanning/properties/neuralegion.properties.json new file mode 100644 index 0000000..ee64a52 --- /dev/null +++ b/code-scanning/properties/neuralegion.properties.json @@ -0,0 +1,24 @@ +{ + "name": "NeuraLegion", + "creator": "NeuraLegion", + "description": "Scans any target, whether Web Apps, APIs (REST. & SOAP, GraphQL & more), Web sockets or mobile, providing actionable reports", + "iconName": "neuralegion", + "categories": [ + "Code Scanning", + "C", + "C#", + "C++", + "Go", + "Java", + "JavaScript", + "Kotlin", + "Objective C", + "PHP", + "Python", + "Ruby", + "Rust", + "Scala", + "Swift", + "TypeScript" + ] +} diff --git a/icons/neuralegion.svg b/icons/neuralegion.svg new file mode 100644 index 0000000..0534225 --- /dev/null +++ b/icons/neuralegion.svg @@ -0,0 +1,57 @@ + + + + + + + + + NeuraLegion Logo + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From d09e57c7a386f2c92c1d0d5af960c03c79b02eb0 Mon Sep 17 00:00:00 2001 From: Abir Majumdar <83433840+abirismyname@users.noreply.github.com> Date: Thu, 28 Apr 2022 15:22:57 -0400 Subject: [PATCH 12/23] Adding workflow for sobelow (static analysis tool for the Phoenix framework) (#1528) * Adding sobelow workflow * Removing setup-beam dependency * Updating instructions --- .../properties/sobelow.properties.json | 11 +++++ code-scanning/sobelow.yml | 40 +++++++++++++++++++ icons/sobelow.svg | 20 ++++++++++ 3 files changed, 71 insertions(+) create mode 100644 code-scanning/properties/sobelow.properties.json create mode 100644 code-scanning/sobelow.yml create mode 100644 icons/sobelow.svg diff --git a/code-scanning/properties/sobelow.properties.json b/code-scanning/properties/sobelow.properties.json new file mode 100644 index 0000000..163e866 --- /dev/null +++ b/code-scanning/properties/sobelow.properties.json @@ -0,0 +1,11 @@ +{ + "name": "Sobelow", + "creator": "nccgroup", + "description": "Sobelow is a security-focused static analysis tool for the Phoenix framework.", + "iconName": "sobelow", + "categories": [ + "Code Scanning", + "Elixir" + ] + } + \ No newline at end of file diff --git a/code-scanning/sobelow.yml b/code-scanning/sobelow.yml new file mode 100644 index 0000000..21cb6e7 --- /dev/null +++ b/code-scanning/sobelow.yml @@ -0,0 +1,40 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# Sobelow is a security-focused static analysis tool for the Phoenix framework. https://sobelow.io/ +# +# To use this workflow, you must have GitHub Advanced Security (GHAS) enabled for your repository. +# +# Instructions: +# 2. Follow the annotated workflow below and make any necessary modifications then save the workflow to your repository +# and review the "Security" tab once the action has run. +name: Sobelow + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +permissions: + contents: read + +jobs: + security-scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v3 + - id: run-action + uses: sobelow/action@1afd6d2cae70ae8bd900b58506f54487ed863912 + - name: Upload report + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: results.sarif diff --git a/icons/sobelow.svg b/icons/sobelow.svg new file mode 100644 index 0000000..4d243ea --- /dev/null +++ b/icons/sobelow.svg @@ -0,0 +1,20 @@ + + + + + + + + From 5aba2798002b169baefab50eb36b19f8d4649fe0 Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Mon, 2 May 2022 06:08:29 +0000 Subject: [PATCH 13/23] addressing review comments --- script/validate-data/index.ts | 20 ++++++++++---------- script/validate-data/settings.json | 18 +++++++++--------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index da4d2d8..5e6327a 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -41,7 +41,7 @@ const propertiesSchema = { } } -async function checkWorkflows(folders: string[], folder_category_map: object[]): Promise { +async function checkWorkflows(folders: string[], allowed_categories: object[]): Promise { const result: WorkflowWithErrors[] = [] const workflow_template_names = new Set() for (const folder of folders) { @@ -56,7 +56,7 @@ async function checkWorkflows(folders: string[], folder_category_map: object[]): const workflowFilePath = join(folder, e.name); const propertiesFilePath = join(folder, "properties", `${fileType}.properties.json`) - const workflowWithErrors = await checkWorkflow(workflowFilePath, propertiesFilePath, folder_category_map); + const workflowWithErrors = await checkWorkflow(workflowFilePath, propertiesFilePath, allowed_categories); if(workflowWithErrors.name && workflow_template_names.size == workflow_template_names.add(workflowWithErrors.name).size) { workflowWithErrors.errors.push(`Workflow template name "${workflowWithErrors.name}" already exists`) } @@ -70,7 +70,7 @@ async function checkWorkflows(folders: string[], folder_category_map: object[]): return result; } -async function checkWorkflow(workflowPath: string, propertiesPath: string, folder_category_map: object[]): Promise { +async function checkWorkflow(workflowPath: string, propertiesPath: string, allowed_categories: object[]): Promise { let workflowErrors: WorkflowWithErrors = { id: workflowPath, name: null, @@ -105,14 +105,14 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, folde } } - var folderName = dirname(workflowPath) - var folder_category = folder_category_map.find( folder_category => folder_category["name"] == folderName)["category"] - if (!workflowPath.endsWith("blank.yml") && ((!properties.categories || properties.categories.length == 0 )|| - properties.categories[0].toLowerCase() !== folder_category.toLowerCase())) { + var path = dirname(workflowPath) + var folder_category = allowed_categories.find( category => category["path"] == path)["name"] + if (!workflowPath.endsWith("blank.yml")) { if(!properties.categories || properties.categories.length == 0) { workflowErrors.errors.push(`Workflow categories cannot be null or empty`) - } else { - workflowErrors.errors.push(`The first category in properties.json categories must be "${folder_category}" for ${basename(folderName)} folder workflow.`) + } + else if(properties.categories[0].toLowerCase() !== folder_category.toLowerCase()) { + workflowErrors.errors.push(`The first category in properties.json categories must be "${folder_category}" for workflow in ${basename(path)} folder.`) } } @@ -129,7 +129,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, folde try { const settings = require("./settings.json"); const erroredWorkflows = await checkWorkflows( - settings.folders, settings.folder_category_map + settings.folders, settings.allowed_categories ) if (erroredWorkflows.length > 0) { diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json index 7d3ecfe..667aff6 100644 --- a/script/validate-data/settings.json +++ b/script/validate-data/settings.json @@ -5,22 +5,22 @@ "../../deployments", "../../code-scanning" ], - "folder_category_map": [ + "allowed_categories": [ { - "name": "../../ci", - "category": "Continuous integration" + "name": "Continuous integration", + "path": "../../ci" }, { - "name": "../../automation", - "category": "Automation" + "name": "Automation", + "path": "../../automation" }, { - "name": "../../deployments", - "category": "Deployment" + "path": "../../deployments", + "name": "Deployment" }, { - "name": "../../code-scanning", - "category": "Code Scanning" + "name": "Code Scanning", + "path": "../../code-scanning" } ] } \ No newline at end of file From c032ee101f95b6b5be02ec2b43f8ad16f9af2e77 Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Mon, 2 May 2022 06:32:43 +0000 Subject: [PATCH 14/23] adding dependency review to allowed categories --- script/validate-data/index.ts | 8 ++++---- script/validate-data/settings.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index 5e6327a..7f7aa44 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -106,17 +106,17 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow } var path = dirname(workflowPath) - var folder_category = allowed_categories.find( category => category["path"] == path)["name"] + var folder_categories = allowed_categories.find( category => category["path"] == path)["categories"] if (!workflowPath.endsWith("blank.yml")) { if(!properties.categories || properties.categories.length == 0) { workflowErrors.errors.push(`Workflow categories cannot be null or empty`) } - else if(properties.categories[0].toLowerCase() !== folder_category.toLowerCase()) { - workflowErrors.errors.push(`The first category in properties.json categories must be "${folder_category}" for workflow in ${basename(path)} folder.`) + else if(!folder_categories.some(category => properties.categories[0].toLowerCase() == category.toLowerCase())) { + workflowErrors.errors.push(`The first category in properties.json categories for workflow in ${basename(path)} folder must be one of "${folder_categories}"`) } } - if(folder_category.toLowerCase() == 'deployment' && !properties.creator) { + if(path.toLowerCase() == 'deployment' && !properties.creator) { workflowErrors.errors.push(`The "creator" in properties.json must be present.`) } } catch (e) { diff --git a/script/validate-data/settings.json b/script/validate-data/settings.json index 2765c2a..852f575 100644 --- a/script/validate-data/settings.json +++ b/script/validate-data/settings.json @@ -20,7 +20,7 @@ }, { "path": "../../code-scanning", - "categories": ["Code Scanning", "Dependency review"], + "categories": ["Code Scanning", "Dependency review"] } ] } From ca970a212491702286740f8f0b943e097bdb4de3 Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Mon, 2 May 2022 12:23:29 +0530 Subject: [PATCH 15/23] Fix typo --- code-scanning/properties/dependency-review.properties.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/properties/dependency-review.properties.json b/code-scanning/properties/dependency-review.properties.json index e84278c..c195c73 100644 --- a/code-scanning/properties/dependency-review.properties.json +++ b/code-scanning/properties/dependency-review.properties.json @@ -1,6 +1,6 @@ { "name": "Dependency Review", - "description": "Scans Pull Requests on each push for the introduction and/or resolution of vulnerable depdendencies to the repository", + "description": "Scans Pull Requests on each push for the introduction and/or resolution of vulnerable dependencies to the repository", "iconName": "octicon mark-github", "categories": [ "Dependency review", From 74122beced91569ee2a4181188911aae18aa909e Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Mon, 2 May 2022 13:22:36 +0000 Subject: [PATCH 16/23] Fixing creator check --- script/validate-data/index.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index 7f7aa44..39328c5 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -116,7 +116,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow } } - if(path.toLowerCase() == 'deployment' && !properties.creator) { + if(basename(path).toLowerCase() == 'deployments' && !properties.creator) { workflowErrors.errors.push(`The "creator" in properties.json must be present.`) } } catch (e) { From f007e412eef70494c18a54191728f1138e84436b Mon Sep 17 00:00:00 2001 From: Daniel Schultz Date: Tue, 22 Mar 2022 21:17:20 -0400 Subject: [PATCH 17/23] Rename sync-ghes workflow for consistancy Issue #1497 --- .github/workflows/{sync_ghes.yaml => sync-ghes.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{sync_ghes.yaml => sync-ghes.yaml} (100%) diff --git a/.github/workflows/sync_ghes.yaml b/.github/workflows/sync-ghes.yaml similarity index 100% rename from .github/workflows/sync_ghes.yaml rename to .github/workflows/sync-ghes.yaml From 52bd793f345de13bebd632f87f1d4544eb724768 Mon Sep 17 00:00:00 2001 From: Anurag Chauhan <44864882+anuragc617@users.noreply.github.com> Date: Tue, 3 May 2022 11:00:55 +0530 Subject: [PATCH 18/23] Update script/validate-data/index.ts Co-authored-by: Bishal Prasad --- script/validate-data/index.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/script/validate-data/index.ts b/script/validate-data/index.ts index 39328c5..4bd260d 100755 --- a/script/validate-data/index.ts +++ b/script/validate-data/index.ts @@ -112,7 +112,7 @@ async function checkWorkflow(workflowPath: string, propertiesPath: string, allow workflowErrors.errors.push(`Workflow categories cannot be null or empty`) } else if(!folder_categories.some(category => properties.categories[0].toLowerCase() == category.toLowerCase())) { - workflowErrors.errors.push(`The first category in properties.json categories for workflow in ${basename(path)} folder must be one of "${folder_categories}"`) + workflowErrors.errors.push(`The first category in properties.json categories for workflow in ${basename(path)} folder must be one of "${folder_categories}. Either move the workflow to an appropriate directory or change the category."`) } } From 2e396aeae52f0e011e01e06e2935845ce3b0cbd9 Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Wed, 4 May 2022 16:07:22 +0530 Subject: [PATCH 19/23] Create auto_assign.yml --- .github/auto_assign.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/auto_assign.yml diff --git a/.github/auto_assign.yml b/.github/auto_assign.yml new file mode 100644 index 0000000..02596ef --- /dev/null +++ b/.github/auto_assign.yml @@ -0,0 +1,16 @@ +# Set to true to add reviewers to pull requests +addReviewers: true + +# Set to true to add assignees to pull requests +addAssignees: false + +# A list of reviewers to be added to pull requests (GitHub user name) +reviewers: + - phantsure + - anuragc617 + - tiwarishub + - vsvipul + +# A number of reviewers added to the pull request +# Set 0 to add all the reviewers (default: 0) +numberOfReviewers: 1 From a2c02154b7ea27f764122739baf04c91934f5da1 Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Wed, 4 May 2022 16:20:25 +0530 Subject: [PATCH 20/23] Create auto_assign.yml --- .github/workflows/auto_assign.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/workflows/auto_assign.yml diff --git a/.github/workflows/auto_assign.yml b/.github/workflows/auto_assign.yml new file mode 100644 index 0000000..4dcc612 --- /dev/null +++ b/.github/workflows/auto_assign.yml @@ -0,0 +1,10 @@ +name: 'Auto Assign' +on: + pull_request: + types: [opened, ready_for_review] + +jobs: + add-reviews: + runs-on: ubuntu-latest + steps: + - uses: kentaro-m/auto-assign-action@v1.2.1 From 49f91dc3426c0d13cb30524f991926c9abb64f9e Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Wed, 4 May 2022 16:30:09 +0530 Subject: [PATCH 21/23] Auto issue assignment --- .github/workflows/auto-assign-issues.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/auto-assign-issues.yml diff --git a/.github/workflows/auto-assign-issues.yml b/.github/workflows/auto-assign-issues.yml new file mode 100644 index 0000000..b8406e9 --- /dev/null +++ b/.github/workflows/auto-assign-issues.yml @@ -0,0 +1,15 @@ +name: Issue assignment + +on: + issues: + types: [opened] + +jobs: + auto-assign: + runs-on: ubuntu-latest + steps: + - name: 'Auto-assign issue' + uses: pozil/auto-assign-issue@v1.4.0 + with: + assignees: phantsure,tiwarishub,anuragc617,vsvipul,bishal-pdmsft + numOfAssignee: 1 From 52fc31bdb1e5c4cd28755f48b5c6ed09abaa65fb Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Wed, 4 May 2022 16:35:40 +0530 Subject: [PATCH 22/23] Rename auto_assign.yml to auto-assign.yml --- .github/workflows/{auto_assign.yml => auto-assign.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{auto_assign.yml => auto-assign.yml} (100%) diff --git a/.github/workflows/auto_assign.yml b/.github/workflows/auto-assign.yml similarity index 100% rename from .github/workflows/auto_assign.yml rename to .github/workflows/auto-assign.yml From 41b1bb864a4f82c9c0b08e7b1364b2d5d0943ab8 Mon Sep 17 00:00:00 2001 From: Sampark Sharma Date: Wed, 4 May 2022 16:36:39 +0530 Subject: [PATCH 23/23] Adding bishal-pdmsft as a reviewer --- .github/auto_assign.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/auto_assign.yml b/.github/auto_assign.yml index 02596ef..696b4f8 100644 --- a/.github/auto_assign.yml +++ b/.github/auto_assign.yml @@ -10,6 +10,7 @@ reviewers: - anuragc617 - tiwarishub - vsvipul + - bishal-pdmsft # A number of reviewers added to the pull request # Set 0 to add all the reviewers (default: 0)