Skip to content

Commit e39c8b1

Browse files
maxammannmaxammann
committed
add actions for zizmor and scorecard
1 parent fce8814 commit e39c8b1

File tree

6 files changed

+123
-66
lines changed

6 files changed

+123
-66
lines changed

‎.github/actions/scorecard-action/action.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: 'Scorecard Scan'
2+
description: 'Run OSSF scorecard'
3+
runs:
4+
using: 'composite'
5+
steps:
6+
- name: "Run scorecard"
7+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
8+
with:
9+
results_file: results.sarif
10+
results_format: sarif
11+
publish_results: false
12+
env:
13+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
14+
shell: bash

‎.github/actions/semgrep-action/action.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: 'Semgrep Scan'
2+
description: 'Run Semgrep scan with custom rules and output results'
3+
runs:
4+
using: 'composite'
5+
steps:
6+
- name: "Fetch semgrep rules"
7+
run: |
8+
git clone https://github.com/trailofbits/semgrep-rules $HOME/semgrep-rules-tob
9+
git clone https://github.com/semgrep/semgrep-rules $HOME/semgrep-rules
10+
git -C $HOME/semgrep-rules reset --hard 518f71b883d431fa33268844b066033507e7c1b5
11+
git -C $HOME/semgrep-rules-tob reset --hard 3b91c9b622b4a250b144a832ce73091b1f25e207
12+
rm $HOME/semgrep-rules-tob/.github/workflows/update-semgrep-registry.yml
13+
rm $HOME/semgrep-rules/.pre-commit-config.yaml
14+
rm -rf $HOME/semgrep-rules-tob/.github
15+
rm -rf $HOME/semgrep-rules/.github
16+
rm -rf $HOME/semgrep-rules/stats
17+
shell: bash
18+
- name: "Setup git repo"
19+
run: git config --global --add safe.directory $(pwd)
20+
shell: bash
21+
- name: "Run semgrep"
22+
run: |
23+
semgrep scan --config $HOME/semgrep-rules --config $HOME/semgrep-rules-tob \
24+
--metrics=off --experimental \
25+
--exclude-rule=third-party-action-not-pinned-to-commit-sha \
26+
--exclude-rule=jsx-not-internationalized \
27+
--severity=WARNING \
28+
--severity=ERROR \
29+
--exclude="*.html" --exclude="*.js" \
30+
--baseline-commit=${{ github.event.pull_request.base.sha }} \
31+
--json > /tmp/semgrep-results.json || true
32+
shell: bash
33+
- name: Show results in PR
34+
run: |
35+
/usr/bin/jq -r '.results[]
36+
| . + {
37+
severity: (
38+
if .extra.severity == "WARNING" then "warning"
39+
elif .extra.severity == "ERROR" then "error"
40+
else "notice"
41+
end
42+
)
43+
}
44+
| "::\(.severity) file=\(.path),line=\(.start.line),col=\(.start.col),endLine=\(.end.line),endColumn=\(.end.col),title=\(.check_id)::\((.extra.message
45+
| gsub("[^a-zA-Z0-9 .]"; "")
46+
))"' /tmp/semgrep-results.json
47+
shell: bash

‎.github/actions/zizmor-action/action.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: 'Zizmor Scan'
2+
description: 'Install uv and run zizmor scan with custom config'
3+
runs:
4+
using: 'composite'
5+
steps:
6+
- name: Install the latest version of uv
7+
uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41
8+
- name: Run zizmor 🌈
9+
run: |
10+
cat <<EOF > zizmor.yml
11+
rules:
12+
unpinned-uses:
13+
disable: true
14+
EOF
15+
uvx zizmor --format=github --config=zizmor.yml .
16+
env:
17+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
18+
shell: bash
19+

‎.github/workflows/security-default-branch.yml‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ on:
44
secrets:
55
DEPENDENCY_TRACK_AUTOMATION_API_KEY:
66
required: true
7+
GH_TOKEN:
8+
required: true
79
push:
810
branches:
911
- main
@@ -16,23 +18,53 @@ permissions:
1618
jobs:
1719
sbom-trivy:
1820
runs-on: ubuntu-latest
19-
2021
container:
2122
image: aquasec/trivy:0.67.2
22-
2323
steps:
2424
- run: trivy --version
2525
- uses: actions/checkout@v3
2626
with:
2727
fetch-depth: 0
28+
persist-credentials: false
2829
- run: trivy fs --format cyclonedx --output /tmp/trivy-cyclonedx.json .
2930
- run: apk --no-cache add curl
3031
- run: |
3132
curl -X "POST" "https://dependency-track-sbom.corp.zoo.dev/api/v1/bom" \
3233
-H 'Content-Type: multipart/form-data' \
3334
-H "X-Api-Key: ${{ secrets.DEPENDENCY_TRACK_AUTOMATION_API_KEY }}" \
3435
-F "autoCreate=true" \
35-
-F "projectName=${{ github.repository }}" \
36-
-F "projectVersion=${{ github.ref_name }}" \
36+
-F "projectName=$PROJECT_NAME" \
37+
-F "projectVersion=$PROJECT_VERSION" \
3738
-F "isLatest=$IS_LATEST" \
3839
-F "bom=@/tmp/trivy-cyclonedx.json"
40+
env:
41+
PROJECT_NAME: ${{ github.repository }}
42+
PROJECT_VERSION: ${{ github.ref_name }}
43+
44+
semgrep:
45+
runs-on: ubuntu-latest
46+
steps:
47+
- uses: actions/checkout@v3
48+
with:
49+
fetch-depth: 0
50+
persist-credentials: false
51+
- uses: ./.github/actions/semgrep-action
52+
53+
zizmor:
54+
runs-on: ubuntu-latest
55+
steps:
56+
- uses: actions/checkout@v3
57+
with:
58+
fetch-depth: 0
59+
persist-credentials: false
60+
- uses: ./.github/actions/zizmor-action
61+
62+
scorecard:
63+
runs-on: ubuntu-latest
64+
steps:
65+
- uses: actions/checkout@v3
66+
with:
67+
fetch-depth: 0
68+
persist-credentials: false
69+
- uses: ./.github/actions/scorecard-action
70+

‎.github/workflows/security-pr.yml‎

Lines changed: 4 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ permissions:
88

99
jobs:
1010
semgrep:
11-
# Skip any PR created by dependabot to avoid permission issues:
12-
if: (github.actor != 'dependabot[bot]')
11+
## Skip any PR created by dependabot to avoid permission issues:
12+
#if: (github.actor != 'dependabot[bot]')
1313
name: semgrep-oss/scan
1414
runs-on: ubuntu-latest
1515
permissions:
@@ -24,47 +24,6 @@ jobs:
2424
- uses: actions/checkout@v3
2525
with:
2626
fetch-depth: 0
27-
- run: |
28-
git clone https://github.com/trailofbits/semgrep-rules $HOME/semgrep-rules-tob
29-
git clone https://github.com/semgrep/semgrep-rules $HOME/semgrep-rules
30-
git -C $HOME/semgrep-rules reset --hard 518f71b883d431fa33268844b066033507e7c1b5
31-
git -C $HOME/semgrep-rules-tob reset --hard 3b91c9b622b4a250b144a832ce73091b1f25e207
32-
rm $HOME/semgrep-rules-tob/.github/workflows/update-semgrep-registry.yml
33-
rm $HOME/semgrep-rules/.pre-commit-config.yaml
34-
rm -rf $HOME/semgrep-rules-tob/.github
35-
rm -rf $HOME/semgrep-rules/.github
36-
rm -rf $HOME/semgrep-rules/stats
37-
- run: git config --global --add safe.directory $(pwd)
38-
- run: |
39-
semgrep scan --config $HOME/semgrep-rules --config $HOME/semgrep-rules-tob \
40-
--metrics=off --experimental \
41-
--exclude-rule=third-party-action-not-pinned-to-commit-sha \
42-
--exclude-rule=jsx-not-internationalized \
43-
--severity=WARNING \
44-
--severity=ERROR \
45-
--exclude="*.html" --exclude="*.js" \
46-
--baseline-commit=${{ github.event.pull_request.base.sha }} \
47-
--json > /tmp/semgrep-results.json || true
48-
- run: /usr/bin/jq --version
49-
- name: Notice
50-
shell: bash
51-
run: |
52-
/usr/bin/jq -r '.results[]
53-
| . + {
54-
severity: (
55-
if .extra.severity == "WARNING" then "warning"
56-
elif .extra.severity == "ERROR" then "error"
57-
else "notice"
58-
end
59-
)
60-
}
61-
| "::\(.severity) file=\(.path),line=\(.start.line),col=\(.start.col),endLine=\(.end.line),endColumn=\(.end.col),title=\(.check_id)::\((.extra.message
62-
| gsub("[^a-zA-Z0-9 .]"; "")
63-
))"' /tmp/semgrep-results.json
64-
# - name: Upload SARIF file
65-
# uses: github/codeql-action/upload-sarif@v2
66-
# with:
67-
# # Path to SARIF file relative to the root of the repository
68-
# sarif_file: /tmp/semgrep-results.sarif
69-
# if: always()
27+
persist-credentials: false
28+
- uses: ./.github/actions/semgrep-action
7029

‎.github/workflows/security-testing-pr.yml‎

Lines changed: 3 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,13 @@ jobs:
1111
name: zizmor
1212
runs-on: ubuntu-latest
1313
permissions:
14-
security-events: write # needed for SARIF uploads
1514
contents: read # only needed for private repos
1615
actions: read # only needed for private repos
1716
steps:
1817
- name: Checkout repository
1918
uses: actions/checkout@v6
2019
with:
20+
fetch-depth: 0
2121
persist-credentials: false
22-
23-
- name: Install the latest version of uv
24-
uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
25-
26-
- name: Run zizmor 🌈
27-
run: |
28-
cat <<EOF > zizmor.yml
29-
rules:
30-
unpinned-uses:
31-
disable: true
32-
EOF
33-
34-
uvx zizmor --format=github --config=zizmor.yml .
35-
env:
36-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
37-
22+
- uses: ./.github/actions/zizmor-action
23+
with: {}

0 commit comments

Comments
 (0)