Skip to content

Commit b6ebf30

Browse files
cx-artur-ribeirocx-artur-ribeiro
authored
Merge branch 'master' into AST-124908-FP-Security_groups_not_used-Terraform/aws
2 parents 9c17dad + 1c3915c commit b6ebf30

File tree

614 files changed

+27791
-7624
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

614 files changed

+27791
-7624
lines changed

‎.github/workflows/cesar.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: CESARt
2+
on:
3+
pull_request:
4+
types: [ labeled ]
5+
6+
env:
7+
ENGINE_VERSION: ${{ vars.CES_ENGINE_VERSION }}
8+
PLATFORM: "LINUX_X64"
9+
ENGINE: "kics"
10+
REMOVE_HISTORY: "true"
11+
12+
jobs:
13+
build:
14+
if: (github.event.label.name == 'cesar' && github.event.pull_request.mergeable == true)
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
19+
with:
20+
ref: refs/pull/${{ github.event.pull_request.number }}/merge
21+
path: kics
22+
23+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
24+
with:
25+
go-version-file: kics/go.mod
26+
cache-dependency-path: kics/go.sum
27+
cache: true
28+
29+
- name: Build kics Binary
30+
env:
31+
CGO_ENABLED: 0
32+
GOOS: linux
33+
GOARCH: amd64
34+
run: |
35+
cd $GITHUB_WORKSPACE/kics
36+
go build -installsuffix cgo -ldflags "-s -w" -a -o ./bin/kics ./cmd/console/main.go
37+
chmod +x ./bin/kics
38+
39+
- name: Create Metadata File
40+
run: |
41+
COMMIT_TIMESTAMP=$(git -C "$GITHUB_WORKSPACE/kics" log -1 --format=%ct)
42+
METADATA_PATH="$GITHUB_WORKSPACE/pr-metadata.json"
43+
CURR_TIMESTAMP=$(date +%s)
44+
echo '{
45+
"seq": "'"${CURR_TIMESTAMP}"'",
46+
"tag": "'"${{ github.event.number }}"'",
47+
"comment": "'"${{ github.event.pull_request.title }}"'",
48+
"commit": "'"${{ github.event.pull_request.head.sha }}"'",
49+
"owner": "'"${{ github.actor }}"'",
50+
"branch": "'"${{ github.head_ref }}"'",
51+
"engine": "'"${ENGINE}"'",
52+
"platform": "'"${PLATFORM}"'",
53+
"version": "'"${ENGINE_VERSION}"'",
54+
"forkSeq": "'"${CURR_TIMESTAMP}"'",
55+
"forkBranch": "'"${{ github.base_ref }}"'",
56+
"removeHistory" : "'"${REMOVE_HISTORY}"'"
57+
}' > "$METADATA_PATH"
58+
59+
- name: Zip kics Folder
60+
run: |
61+
cd $GITHUB_WORKSPACE
62+
zip -qr kics.zip kics/
63+
64+
- name: Save kics
65+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
66+
with:
67+
name: kics
68+
path: ${{ github.workspace }}/kics.zip
69+
retention-days: 1
70+
71+
- name: Pr parameters
72+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
73+
with:
74+
name: Metadata
75+
path: ${{ github.workspace }}/pr-metadata.json
76+
retention-days: 1
77+
78+
ci-projects:
79+
needs: build
80+
uses: ./.github/workflows/run-projects.yaml
81+
with:
82+
machines-count: 10
83+
secrets: inherit

‎.github/workflows/ci-projects.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: CI Projects
2+
on:
3+
pull_request:
4+
types: [closed]
5+
branches:
6+
- master
7+
8+
env:
9+
ENGINE_VERSION: ${{ vars.CES_ENGINE_VERSION }}
10+
PLATFORM: "LINUX_X64"
11+
ENGINE: "kics"
12+
13+
jobs:
14+
build:
15+
if: github.event.pull_request.merged == true
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
with:
21+
ref: ${{ github.event.pull_request.merge_commit_sha }}
22+
path: kics
23+
24+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
25+
with:
26+
go-version-file: kics/go.mod
27+
cache-dependency-path: kics/go.sum
28+
cache: true
29+
30+
- name: Build kics Binary
31+
env:
32+
CGO_ENABLED: 0
33+
GOOS: linux
34+
GOARCH: amd64
35+
run: |
36+
cd $GITHUB_WORKSPACE/kics
37+
go build -installsuffix cgo -ldflags "-s -w" -a -o ./bin/kics ./cmd/console/main.go
38+
chmod +x ./bin/kics
39+
40+
- name: Create Metadata File
41+
run: |
42+
COMMIT_TIMESTAMP=$(git -C "$GITHUB_WORKSPACE/kics" log -1 --format=%ct)
43+
METADATA_PATH="$GITHUB_WORKSPACE/pr-metadata.json"
44+
echo '{
45+
"seq": "'"${COMMIT_TIMESTAMP}"'",
46+
"tag": "'"${{ github.event.number }}"'",
47+
"comment": "'"${{ github.event.pull_request.title }}"'",
48+
"commit": "'"${{ github.sha }}"'",
49+
"owner": "'"${{ github.actor }}"'",
50+
"branch": "'"${{ github.base_ref }}"'",
51+
"engine": "'"${ENGINE}"'",
52+
"platform": "'"${PLATFORM}"'",
53+
"version": "'"${ENGINE_VERSION}"'"
54+
}' > "$METADATA_PATH"
55+
56+
- name: Zip kics Folder
57+
run: |
58+
cd $GITHUB_WORKSPACE
59+
zip -qr kics.zip kics/
60+
61+
- name: Save kics
62+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
63+
with:
64+
name: kics
65+
path: ${{ github.workspace }}/kics.zip
66+
retention-days: 1
67+
68+
- name: Pr parameters
69+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
70+
with:
71+
name: Metadata
72+
path: ${{ github.workspace }}/pr-metadata.json
73+
retention-days: 1
74+
75+
ci-projects:
76+
needs: build
77+
uses: ./.github/workflows/run-projects.yaml
78+
with:
79+
machines-count: 10
80+
secrets: inherit

‎.github/workflows/kics-gh-action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
steps:
1212
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1313
- name: Run KICS Scan
14-
uses: checkmarx/kics-github-action@e01759d524f8abd5bd650d3d5bd4b96d46ebbc1d # v2.1.17
14+
uses: checkmarx/kics-github-action@63fca4ca72e56edbb5a599ee756e6af1fdb1e785 # v2.1.18
1515
with:
1616
token: ${{ secrets.GITHUB_TOKEN }}
1717
path: "./Dockerfile"

‎.github/workflows/run-projects.yaml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
name: Run CI Projects
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
machines-count:
7+
description: 'Total number of machines'
8+
required: true
9+
type: number
10+
11+
env:
12+
ENGINE: "kics"
13+
CES_ENVIRONMENT: "prod"
14+
15+
jobs:
16+
setup:
17+
runs-on: ubuntu-latest
18+
outputs:
19+
machines: ${{ steps.set-machines.outputs.machines }}
20+
steps:
21+
- name: Generate Machine Matrix
22+
id: set-machines
23+
run: |
24+
machines=$(seq -s, 0 $((${{ inputs.machines-count }} - 1)))
25+
echo "machines=[$machines]" >> "$GITHUB_OUTPUT"
26+
27+
run-projects:
28+
needs: setup
29+
runs-on: ubuntu-latest
30+
env:
31+
AWS_ACCESS_KEY_ID: ${{ secrets.CES_BUCKET_AWS_ACCESS_KEY }}
32+
AWS_SECRET_ACCESS_KEY: ${{ secrets.CES_BUCKET_AWS_SECRET_ACCESS_KEY }}
33+
AWS_REGION: ${{ secrets.CES_BUCKET_AWS_REGION }}
34+
35+
strategy:
36+
fail-fast: false
37+
max-parallel: 10
38+
matrix:
39+
machine: ${{ fromJSON(needs.setup.outputs.machines) }}
40+
41+
steps:
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
43+
with:
44+
repository: ${{ secrets.CES_EXECUTOR_REPO }}
45+
token: ${{ secrets.CX_CEBOT_GITHUB_TOKEN_CHECKMARX }}
46+
path: cli
47+
ref: master
48+
49+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
50+
with:
51+
go-version-file: cli/go.mod
52+
cache: false
53+
54+
- name: Download kics
55+
uses: actions/[email protected]
56+
with:
57+
name: kics
58+
path: .
59+
60+
- name: Unzip kics
61+
run: |
62+
unzip -q kics.zip
63+
64+
- name: Download Json
65+
uses: actions/[email protected]
66+
with:
67+
name: Metadata
68+
path: .
69+
70+
- name: Build Engines Executor
71+
run: |
72+
cd cli
73+
go build -o executor
74+
75+
- name: Set log file
76+
run: |
77+
LOG_FILE="$GITHUB_WORKSPACE/log_${{ matrix.machine }}.log"
78+
echo "LOG_FILE=$LOG_FILE" >> $GITHUB_ENV
79+
80+
- name: Select Projects
81+
run: |
82+
mkdir -p "$GITHUB_WORKSPACE/zips/"
83+
cd cli
84+
./executor sources \
85+
-s $GITHUB_WORKSPACE/zips/ \
86+
-e $ENGINE \
87+
--chunk ${{ matrix.machine }} \
88+
--machines ${{ inputs.machines-count }} \
89+
>> "$LOG_FILE" 2>&1
90+
91+
- name: Prepare Projects
92+
run: |
93+
cd "$GITHUB_WORKSPACE/zips/"
94+
for zip in *.zip; do
95+
[ -e "$zip" ] || continue
96+
zip_name=$(basename "$zip" .zip)
97+
echo "::add-mask::$zip_name"
98+
unzip -qqo "$zip" -d "./$zip_name" >> "$LOG_FILE" 2>&1
99+
done
100+
101+
- name: Run Engines Executor
102+
run: |
103+
mkdir -p $GITHUB_WORKSPACE/results
104+
./cli/executor run kics \
105+
-b $GITHUB_WORKSPACE/kics/bin/kics \
106+
-s $GITHUB_WORKSPACE/zips/ \
107+
-r $GITHUB_WORKSPACE/results \
108+
-j $GITHUB_WORKSPACE/pr-metadata.json \
109+
-q $GITHUB_WORKSPACE/kics/assets/queries/ \
110+
--libraries $GITHUB_WORKSPACE/kics/assets/libraries/ \
111+
--assets $GITHUB_WORKSPACE/kics/assets/similarityID_transition/ \
112+
--env $CES_ENVIRONMENT \
113+
>> $LOG_FILE 2>&1
114+
115+
- name: Upload log
116+
if: failure()
117+
run: |
118+
./cli/executor save-log \
119+
-e $ENGINE \
120+
-j $GITHUB_WORKSPACE/pr-metadata.json \
121+
-l $LOG_FILE \
122+
--env $CES_ENVIRONMENT \
123+
> /dev/null 2>&1

‎.github/workflows/sec-checks.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ jobs:
8787
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8888
- name: Run Grype vulnerability scanner in repo mode
8989
id: grype-fs-scan
90-
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
90+
uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # 7.2.2
9191
with:
9292
path: "."
9393
only-fixed: true
@@ -125,7 +125,7 @@ jobs:
125125
cache-to: type=local,dest=/tmp/.buildx-cache
126126
- name: Scan image
127127
id: grype-image-scan
128-
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
128+
uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # 7.2.2
129129
with:
130130
image: kics:sec-tests-${{ github.sha }}
131131
only-fixed: true
@@ -192,4 +192,4 @@ jobs:
192192
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
193193
with:
194194
name: binary-dependencies
195-
path: ./binary_dependencies.txt
195+
path: ./binary_dependencies.txt

0 commit comments

Comments
 (0)