Skip to content

Commit a2a76e3

Browse files
cx-leonardo-fontescx-leonardo-fontes
committed
Merge branch 'master' into pre-receive
2 parents 9a15b4f + ae4e0e4 commit a2a76e3

25 files changed

+1576
-222
lines changed

‎.2ms.yml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,10 +63,29 @@ ignore-result:
6363
- ba04dd95db7fd550ebb0f295d80fce4e281529fb # value used for testing, found at https://github.com/Checkmarx/2ms/pull/288/commits/2cdf66865f2bdf006869b8a84f448bec3525bfa0
6464
- 35a133edb564767157c6bd807f57009a9ee78349 # value used for testing, found at https://github.com/Checkmarx/2ms/pull/288/commits/2cdf66865f2bdf006869b8a84f448bec3525bfa0
6565
- 854547fc6e35c0d1f63c0f4d426aebd4d64679fc # False positive, see https://github.com/gitleaks/gitleaks/pull/1358, found at https://github.com/Checkmarx/2ms/commit/45a5c9d35ff910dfec5e5a76cdedb8977da5dd34#diff-d712d2256df359061d691b711ca7ed30ba408199b1e3801cef289779778d8bad
66+
- ae0f7e65c291d7f0ea998dfa77485bfc632e5d62 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
67+
- 99f9ffb901cb72a0282ce32cf7dc050e5225cd81 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
68+
- bdd20706ea03aa38c8c9f3f87200cf6ab9010a53 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
69+
- 1bd84965941175ee61639964adbff6170bea7703 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
70+
- f86543794ab8c77a54adc91581dcf72bfef6bf78 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
71+
- 0f80a32cc85ea5c04b65dbf7d6db6ddb8c2e4d29 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
72+
- 29a593e19a06c138d63468b8a028696ccdfc7eb2 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
73+
- 8149f62cd847f3c4ba5ffc502bdcb8d66e800c7f # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
74+
- e3b354d102fe73cd4f4016e1ee17e468256d2ae8 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
75+
- 5c2e640a480ca64c809133e1b157fd97960356bf # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
76+
- 92b1996f9815a2fbd9299a1997ce0bc2c153624f # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
77+
- 7b7c1a0b1c5760490d843e0b9bfe540665d20b28 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
78+
- c9ae034a5a03a540d50a2686f74fcbb5117f181c # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
79+
- b7c3ac03d8a24892a2c4be5810ce73ffdf6ba3ae # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
80+
- f40881f8369f0d90670fc22a719ecd0ba9cb2f02 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
6681
- b7c3ac03d8a24892a2c4be5810ce73ffdf6ba3ae # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
6782
- f40881f8369f0d90670fc22a719ecd0ba9cb2f02 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
6883
- 35a5080cb11d663e33e3ced8f39a24920ca44c8a # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
6984
- 7b7c1a0b1c5760490d843e0b9bfe540665d20b28 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
7085
- 92b1996f9815a2fbd9299a1997ce0bc2c153624f # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
7186
- bf2e01278453a987f05b69e6c536358cab343322 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
72-
- c9ae034a5a03a540d50a2686f74fcbb5117f181c # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
87+
- c9ae034a5a03a540d50a2686f74fcbb5117f181c # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
88+
- f9e5e0b35a39914c67ee1660191a356d3c7ab1db # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
89+
- 777f3d460d69a70e2ce760ca757b18f2aa984392 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
90+
- e392318c730d4cd0a04340f1e3d41d4c61f6eb20 # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10
91+
- 8f0e0442b01c18b02cfb8e59555103f8233fc7bf # value used for testing, found at https://github.com/Checkmarx/2ms/commit/07aab5bb214c03fd9e75e46cebe2b407c88d4f73/reporting/report_test.go#diff-31d71ec2c2ba169dce79b1c2de097e30b43f1695ce364054ee7d6b33896c7040R10

‎.github/workflows/ast-scan.yml‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.github/workflows/cx-one-scan.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: cx-one-scan
2+
3+
on:
4+
workflow_dispatch:
5+
pull_request:
6+
push:
7+
branches:
8+
- master
9+
schedule:
10+
- cron: '00 7 * * *'
11+
12+
jobs:
13+
cx-one-scan:
14+
name: cx-one-scan
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
- name: Checkmarx One CLI Action
20+
uses: checkmarx/ast-github-action@86e9ae570a811f9a1fb85903647a307aa3bf6253 # 2.0.44
21+
with:
22+
base_uri: ${{ secrets.AST_RND_SCANS_BASE_URI }}
23+
cx_tenant: ${{ secrets.AST_RND_SCANS_TENANT }}
24+
cx_client_id: ${{ secrets.AST_RND_SCANS_CLIENT_ID }}
25+
cx_client_secret: ${{ secrets.AST_RND_SCANS_CLIENT_SECRET }}
26+
additional_params: --tags scs --threshold "sast-critical=1; sast-high=1; sast-medium=1; sast-low=1; sca-critical=1; sca-high=1; sca-medium=1; sca-low=1; iac-security-critical=1; iac-security-high=1; iac-security-medium=1;iac-security-low=1"

‎.github/workflows/security.yml‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -33,37 +33,6 @@ jobs:
3333
- name: Set up Docker Buildx
3434
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb #v3.3.0
3535

36-
trivy-scanning:
37-
runs-on: ubuntu-latest
38-
steps:
39-
- name: Checkout Source
40-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
41-
42-
- name: Build and load (not push)
43-
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
44-
with:
45-
load: true
46-
context: .
47-
file: ./Dockerfile
48-
platforms: linux/amd64
49-
push: false
50-
tags: checkmarx/2ms:scanme
51-
52-
- name: Run Trivy Scan
53-
uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
54-
with:
55-
image-ref: checkmarx/2ms:scanme
56-
vuln-type: os,library
57-
format: table
58-
ignore-unfixed: true
59-
severity: CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN
60-
trivy-config: trivy.yaml
61-
exit-code: '1'
62-
env:
63-
TRIVY_SKIP_DB_UPDATE: true
64-
TRIVY_SKIP_JAVA_DB_UPDATE: true
65-
66-
6736
secret-scanning:
6837
runs-on: ubuntu-latest
6938
steps:

.github/workflows/update-trivy-cache.yml renamed to .github/workflows/trivy-cache.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,4 @@ jobs:
3636
uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 #v4.2.0
3737
with:
3838
path: ${{ github.workspace }}/.cache/trivy
39-
key: cache-trivy-${{ steps.date.outputs.date }}
39+
key: cache-trivy-${{ steps.date.outputs.date }}

‎.github/workflows/trivy-vulnerability-scan.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Trivy-scan
2+
on:
3+
push:
4+
workflow_dispatch:
5+
pull_request:
6+
branches:
7+
- master
8+
schedule:
9+
- cron: '5 6 * * *' # Runs every day at 06:05 UTC
10+
11+
jobs:
12+
trivy-scan:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout Source
16+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
17+
18+
- name: Build and load (not push)
19+
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
20+
with:
21+
load: true
22+
context: .
23+
file: ./Dockerfile
24+
platforms: linux/amd64
25+
push: false
26+
tags: checkmarx/2ms:scanme
27+
28+
- name: Run Trivy Scan
29+
uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
30+
with:
31+
image-ref: checkmarx/2ms:scanme
32+
vuln-type: os,library
33+
format: table
34+
ignore-unfixed: true
35+
severity: CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN
36+
trivy-config: trivy.yaml
37+
exit-code: '1'
38+
env:
39+
TRIVY_SKIP_DB_UPDATE: true
40+
TRIVY_SKIP_JAVA_DB_UPDATE: true

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ COPY . .
2020
RUN GOOS=linux GOARCH=amd64 go build -ldflags="-s -w" -a -o /app/2ms .
2121

2222
# Runtime image
23-
FROM cgr.dev/chainguard/git@sha256:b0dbd0c3c6a0f44c0522663c3a7f9b47f8e62ed419c88c37199f61308f19829c
23+
FROM cgr.dev/chainguard/git@sha256:fb9f28194b4dda3ea74c68d731238d1f32023849bca04c5652638e8e199fb956
2424

2525
WORKDIR /app
2626

‎cmd/main.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -131,17 +131,17 @@ func preRun(pluginName string, cmd *cobra.Command, args []string) error {
131131
return err
132132
}
133133

134-
engine, err := engine.Init(engineConfigVar)
134+
engineInstance, err := engine.Init(engineConfigVar)
135135
if err != nil {
136136
return err
137137
}
138138

139-
if err := engine.AddRegexRules(customRegexRuleVar); err != nil {
139+
if err := engineInstance.AddRegexRules(customRegexRuleVar); err != nil {
140140
return err
141141
}
142142

143143
Channels.WaitGroup.Add(1)
144-
go ProcessItems(engine, pluginName)
144+
go ProcessItems(engineInstance, pluginName)
145145

146146
Channels.WaitGroup.Add(1)
147147
go ProcessSecrets()
@@ -151,10 +151,10 @@ func preRun(pluginName string, cmd *cobra.Command, args []string) error {
151151

152152
if validateVar {
153153
Channels.WaitGroup.Add(1)
154-
go ProcessValidationAndScoreWithValidation(engine)
154+
go ProcessValidationAndScoreWithValidation(engineInstance)
155155
} else {
156156
Channels.WaitGroup.Add(1)
157-
go ProcessScoreWithoutValidation(engine)
157+
go ProcessScoreWithoutValidation(engineInstance)
158158
}
159159

160160
return nil

‎cmd/workers.go‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,37 @@
11
package cmd
22

33
import (
4+
"context"
45
"github.com/checkmarx/2ms/engine"
56
"github.com/checkmarx/2ms/engine/extra"
67
"github.com/checkmarx/2ms/lib/secrets"
8+
"golang.org/x/sync/errgroup"
79
"sync"
810
)
911

10-
func ProcessItems(engine *engine.Engine, pluginName string) {
12+
func ProcessItems(engineInstance engine.IEngine, pluginName string) {
1113
defer Channels.WaitGroup.Done()
12-
wgItems := &sync.WaitGroup{}
14+
15+
g, ctx := errgroup.WithContext(context.Background())
1316
for item := range Channels.Items {
1417
Report.TotalItemsScanned++
15-
wgItems.Add(1)
16-
go engine.Detect(item, SecretsChan, wgItems, pluginName, Channels.Errors)
18+
item := item
19+
20+
switch pluginName {
21+
case "filesystem":
22+
g.Go(func() error {
23+
return engineInstance.DetectFile(ctx, item, SecretsChan)
24+
})
25+
default:
26+
g.Go(func() error {
27+
return engineInstance.DetectFragment(item, SecretsChan, pluginName)
28+
})
29+
}
30+
}
31+
32+
if err := g.Wait(); err != nil {
33+
Channels.Errors <- err
1734
}
18-
wgItems.Wait()
1935
close(SecretsChan)
2036
}
2137

@@ -48,7 +64,7 @@ func ProcessSecretsExtras() {
4864
wgExtras.Wait()
4965
}
5066

51-
func ProcessValidationAndScoreWithValidation(engine *engine.Engine) {
67+
func ProcessValidationAndScoreWithValidation(engine engine.IEngine) {
5268
defer Channels.WaitGroup.Done()
5369

5470
wgValidation := &sync.WaitGroup{}
@@ -64,7 +80,7 @@ func ProcessValidationAndScoreWithValidation(engine *engine.Engine) {
6480
engine.Validate()
6581
}
6682

67-
func ProcessScoreWithoutValidation(engine *engine.Engine) {
83+
func ProcessScoreWithoutValidation(engine engine.IEngine) {
6884
defer Channels.WaitGroup.Done()
6985

7086
wgScore := &sync.WaitGroup{}

0 commit comments

Comments
 (0)