diff --git a/.github/workflows/Securin-aspm.yaml b/.github/workflows/Securin-aspm.yaml new file mode 100644 index 00000000..82a47739 --- /dev/null +++ b/.github/workflows/Securin-aspm.yaml @@ -0,0 +1,47 @@ +--- +name: Securin-ASPM +on: + pull_request: + branches: + - master + workflow_dispatch: + inputs: + logLevel: + description: Log level +jobs: + scanning: + env: + APP_ID: a804c36e5686bbe83060895305c0f92d718158a0d4f322994941ec2b02246014 + BRANCH_NAME: master + SCAN_ID: a7add0302194143f5f10454d8310bb198bdb31f467d0fcbeb281f663cdafa5d0 + REQ_URL_MAP: "${{toJSON('{\"SL_RESULT_API_HOST\":\"https://slresultapi.securin.io/resultapi\"\ + ,\"SL_RESULTPARSER_API_HOST\":\"https://slresultparserapi.securin.io/resultparserapi\"\ + }')}}" + steps: + - name: Retrieve Token Info + id: auth_token + run: "respJson=$(curl --location --request GET 'https://slresultapi.securin.io/resultapi/aws/ecr/token'\ + \ --header 'X-ASPM-Auth-Key: ${{secrets.ORG_API_KEY}}' --data-raw ' ' )\ + \ \necho \"authTokenJson=$respJson\" >> $GITHUB_OUTPUT" + - uses: actions/checkout@v3 + - name: Scan Initiated + id: sec_scan_init + run: "usrVal=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).user}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrPassword=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).password}}'\ + \ | openssl enc -aes-256-cbc -d -base64 -A -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrPrxyUrl=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).proxyUrl}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrImgTag=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).imageTag}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \ndocker login --username $usrVal --password $usrPassword $usrPrxyUrl\ + \ \ndocker pull -q $usrImgTag \ndocker run -v ${{github.workspace}}:/src \ + \ --volume ${{github.workspace}}:/workdir -v /var/run/docker.sock:/var/run/docker.sock\ + \ $usrImgTag -api_key ${{secrets.ORG_API_KEY}} -wrkspc_id ${{secrets.WORKSPACE_ID}}\ + \ -app_id ${{ env.APP_ID }} -scan_id ${{ env.SCAN_ID }} -branch_name ${{ env.BRANCH_NAME\ + \ }} -req_url_map ${{ env.REQ_URL_MAP }} -tool_name github event:${{ github.event_name\ + \ }} pr_number:${{ github.event.number }} -upload_log true" + - name: Evaluate build status + run: "cat ${{github.workspace}}/results/status.txt\nexit 1\n" + if: hashFiles('**/status.txt') !='' + runs-on: ubuntu-latest diff --git a/.github/workflows/ShiftLeft.yaml b/.github/workflows/ShiftLeft.yaml new file mode 100644 index 00000000..b84de4c2 --- /dev/null +++ b/.github/workflows/ShiftLeft.yaml @@ -0,0 +1,52 @@ +--- +name: Shiftleft Scan +on: + pull_request: + branches: + - master + workflow_dispatch: + inputs: + logLevel: + description: Log level +jobs: + scanning: + env: + APP_ID: 6e4487e629008a3ff4483925941bfdfb650857d21469554eea9fd726d1170518 + BRANCH_NAME: master + SCAN_ID: 8f5c726be7e4acb8f1b3260b880e7f7992524992b59cca9d4a75d130c35c52bb + REQ_URL_MAP: "${{toJSON('{\"SL_RESULT_API_HOST\":\"https://slresultapi.qa.securin.io/resultapi\"\ + ,\"SL_RESULTPARSER_API_HOST\":\"https://slresultparserapi.qa.securin.io/resultparserapi\"\ + }')}}" + steps: + - name: Retrieve Token Info + id: auth_token + run: "respJson=$(curl --location --request GET 'https://slresultapi.qa.securin.io/resultapi/aws/ecr/token'\ + \ --header 'Authorization: Bearer ${{secrets.CLI_ACCESS_TOKEN}}' --data-raw\ + \ ' ' )\necho \"::set-output name=authTokenJson::$respJson\"" + - uses: actions/checkout@v2 + - name: Scan Initiated + id: sec_scan_init + run: "usrVal=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).user}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrPassword=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).password}}'\ + \ | openssl enc -aes-256-cbc -d -base64 -A -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrPrxyUrl=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).proxyUrl}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrImgTag=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).imageTag}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \ndocker login --username $usrVal --password $usrPassword $usrPrxyUrl\ + \ \ndocker pull -q $usrImgTag \ndocker run -v ${{github.workspace}}:/src \ + \ --volume ${{github.workspace}}:/workdir -v /var/run/docker.sock:/var/run/docker.sock\ + \ $usrImgTag -access_tkn ${{secrets.CLI_ACCESS_TOKEN}} -app_id ${{ env.APP_ID\ + \ }} -scan_id ${{ env.SCAN_ID }} -branch_name ${{ env.BRANCH_NAME }} -req_url_map\ + \ ${{ env.REQ_URL_MAP }} -tool_name github event:${{ github.event_name }}\ + \ pr_number:${{ github.event.number }}" + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: "${{github.workspace}}/results/result.sarif" + if: hashFiles('**/result.sarif') !='' + - name: Evaluate build status + run: "cat ${{github.workspace}}/results/status.txt\nexit 1\n" + if: hashFiles('**/status.txt') !='' + runs-on: ubuntu-latest