Skip to content

Commit 58dfce7

Browse files
author
Mateo Ruiz
committed
2 parents 71d5aa7 + ebe309f commit 58dfce7

File tree

587 files changed

+37195
-25103
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

587 files changed

+37195
-25103
lines changed

‎.github/workflows/ScanSecrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
- name: Checkout code
1111
uses: actions/checkout@v4
1212
with:
13-
fetch-depth: 0
13+
fetch-depth: 50
1414
- name: Secret Scanning
1515
uses: trufflesecurity/trufflehog@main
1616
with:

‎.github/workflows/runAsimSchemaAndDataTesters.yaml‎

Lines changed: 181 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
# The script runs ASIM Schema and Data testers on the "eco-connector-test" workspace.
33
name: Run ASIM tests on "ASIM-SchemaDataTester-GithubShared" workspace
44
on:
5-
pull_request:
6-
types: [opened, edited, reopened, synchronize]
5+
pull_request_target:
6+
types: [opened, edited, reopened, synchronize, labeled]
77
branches:
88
- master
99
paths:
@@ -23,18 +23,182 @@ on:
2323
workflow_dispatch:
2424

2525
permissions:
26-
id-token: write
2726
contents: read
2827

28+
concurrency:
29+
group: asim-tests-${{ github.event.pull_request.number || github.sha }}
30+
cancel-in-progress: true
31+
2932
jobs:
33+
# Security gate: Fork PRs require manual approval via "SafeToRun" label
34+
# Internal PRs (same repo) can proceed without labels
35+
security-gate:
36+
name: Security approval gate for fork PRs
37+
runs-on: ubuntu-latest
38+
timeout-minutes: 5
39+
permissions:
40+
contents: read
41+
pull-requests: write
42+
issues: write
43+
outputs:
44+
approved: ${{ steps.check-approval.outputs.approved }}
45+
steps:
46+
- name: Check if PR needs approval
47+
id: check-approval
48+
run: |
49+
# Function to log with consistent formatting
50+
log_info() { echo "ℹ️ $1"; }
51+
log_success() { echo "✅ $1"; }
52+
53+
log_info "Starting PR approval check..."
54+
55+
# Check if this is a fork PR
56+
is_fork="${{ github.event.pull_request.head.repo.fork }}"
57+
log_info "Fork PR: $is_fork"
58+
59+
if [ "$is_fork" = "true" ]; then
60+
log_info "FORK PR DETECTED - Proceeding with security checks"
61+
62+
# Check if "SafeToRun" label is present
63+
labels='${{ toJson(github.event.pull_request.labels.*.name) }}'
64+
log_info "Available labels: $labels"
65+
66+
if echo "$labels" | grep -q "SafeToRun"; then
67+
log_success "'SafeToRun' label found - checking if re-approval needed"
68+
69+
# Check if this workflow was triggered by new commits (synchronize event)
70+
trigger_event="${{ github.event.action }}"
71+
log_info "Workflow triggered by: $trigger_event"
72+
73+
if [ "$trigger_event" = "synchronize" ]; then
74+
log_info "New commits detected on fork PR with existing 'SafeToRun' label"
75+
log_info "Maintainer must remove and re-add the 'SafeToRun' label for security"
76+
echo "approved=false" >> $GITHUB_OUTPUT
77+
echo "needs_approval=false" >> $GITHUB_OUTPUT
78+
echo "comment_needed=true" >> $GITHUB_OUTPUT
79+
exit 1
80+
else
81+
log_success "Label approval granted (no new commits)"
82+
echo "approved=true" >> $GITHUB_OUTPUT
83+
echo "needs_approval=false" >> $GITHUB_OUTPUT
84+
echo "comment_needed=false" >> $GITHUB_OUTPUT
85+
fi
86+
else
87+
log_info "'SafeToRun' label not found - approval required"
88+
echo "approved=false" >> $GITHUB_OUTPUT
89+
echo "needs_approval=true" >> $GITHUB_OUTPUT
90+
echo "comment_needed=true" >> $GITHUB_OUTPUT
91+
exit 1
92+
fi
93+
else
94+
log_success "Internal PR - auto-approved"
95+
echo "approved=true" >> $GITHUB_OUTPUT
96+
echo "needs_approval=false" >> $GITHUB_OUTPUT
97+
echo "comment_needed=false" >> $GITHUB_OUTPUT
98+
fi
99+
100+
- name: Comment on fork PR for approval guidance
101+
if: |
102+
always() &&
103+
github.event.pull_request.head.repo.fork == true &&
104+
steps.check-approval.outputs.comment_needed == 'true'
105+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410
106+
with:
107+
script: |
108+
// Helper function for consistent logging
109+
const log = (level, message) => {
110+
const icons = { info: 'ℹ️', success: '✅', warning: '⚠️', error: '❌' };
111+
console.log(`${icons[level] || 'ℹ️'} ${message}`);
112+
};
113+
114+
log('info', 'Comment step triggered for fork PR approval guidance');
115+
116+
try {
117+
// Fetch existing comments
118+
const { data: comments } = await github.rest.issues.listComments({
119+
owner: context.repo.owner,
120+
repo: context.repo.repo,
121+
issue_number: context.issue.number,
122+
});
123+
124+
// Look for existing security guidance comments
125+
const botComments = comments.filter(comment =>
126+
comment.user.login === 'github-actions[bot]' &&
127+
(comment.body.includes('🔒 **Security Approval Required**') ||
128+
comment.body.includes('🔒 **Security Re-approval Required**'))
129+
);
130+
131+
// Create approval message
132+
const timestamp = new Date().toISOString();
133+
134+
let commentBody;
135+
if ('${{ steps.check-approval.outputs.needs_approval }}' === 'true') {
136+
// Initial approval scenario
137+
commentBody = `🔒 **Security Approval Required**
138+
139+
This fork PR requires manual approval before automated testing can run.
140+
141+
**For security, a maintainer must:**
142+
1. 📝 Review the code changes carefully
143+
2. ✅ **Verify file types** - This PR should only contain \`.yml\`, \`.yaml\`, or \`.json\` files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
144+
3. 🏷️ Add the \`SafeToRun\` label if the changes are safe to execute
145+
146+
**Note**: If new commits are added later, simply remove and re-add the \`SafeToRun\` label.
147+
148+
---
149+
*🤖 Automated security check • Created: ${timestamp}*
150+
*Learn more: [GitHub Security Lab - Preventing PWN Requests](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)*`;
151+
} else {
152+
// Re-approval scenario (new commits with existing label)
153+
commentBody = `🔒 **Security Re-approval Required**
154+
155+
⚠️ **New commits detected**: This fork PR has been updated with new commits while the \`SafeToRun\` label was present.
156+
157+
**For security, a maintainer must:**
158+
1. 📝 Review the latest commits carefully for any security concerns
159+
2. ✅ **Verify file types** - Ensure new commits only contain \`.yml\`, \`.yaml\`, or \`.json\` files. Reject if any executable scripts (.ps1, .py, .sh, .exe, etc.) are included.
160+
3. 🏷️ Remove the \`SafeToRun\` label
161+
4. 🏷️ Re-add the \`SafeToRun\` label if the new commits are safe
162+
163+
This simple process ensures that all commits have been properly reviewed before testing with repository secrets.
164+
165+
---
166+
*🤖 Automated security check • Updated: ${timestamp}*
167+
*Learn more: [GitHub Security Lab - Preventing PWN Requests](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/)*`;
168+
}
169+
170+
// Always create a new comment for maximum visibility
171+
// Keep existing comments for audit trail - don't delete them
172+
log('info', 'Creating new security guidance comment (preserving audit trail)');
173+
await github.rest.issues.createComment({
174+
owner: context.repo.owner,
175+
repo: context.repo.repo,
176+
issue_number: context.issue.number,
177+
body: commentBody
178+
});
179+
log('success', 'Created new security guidance comment');
180+
181+
log('success', 'Comment operation completed successfully');
182+
183+
} catch (error) {
184+
log('error', `Failed to post comment: ${error.message}`);
185+
if (error.response) {
186+
log('error', `API Response: ${error.response.status} - ${error.response.data?.message || 'Unknown error'}`);
187+
}
188+
// Don't fail the step if comment posting fails
189+
log('warning', 'Comment posting failed, but continuing workflow...');
190+
}
191+
30192
Run-ASim-TemplateValidation:
31193
name: Run ASim Template Validation tests
194+
needs: security-gate
195+
if: needs.security-gate.outputs.approved == 'true'
32196
runs-on: ubuntu-latest
33197
steps:
34198
- name: Checkout pull request branch
35199
uses: actions/checkout@v3
36200
with:
37-
ref: ${{github.event.pull_request.head.ref}}
201+
ref: ${{github.event.pull_request.head.sha}}
38202
repository: ${{github.event.pull_request.head.repo.full_name}}
39203
persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
40204
fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
@@ -78,11 +242,14 @@ jobs:
78242
needs: Run-ASim-TemplateValidation
79243
name: Run ASim Sample Data Ingestion
80244
runs-on: ubuntu-latest
245+
permissions:
246+
id-token: write
247+
contents: read
81248
steps:
82249
- name: Checkout pull request branch
83250
uses: actions/checkout@v4
84251
with:
85-
ref: ${{github.event.pull_request.head.ref}}
252+
ref: ${{github.event.pull_request.head.sha}}
86253
repository: ${{github.event.pull_request.head.repo.full_name}}
87254
persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
88255
fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
@@ -136,11 +303,14 @@ jobs:
136303
needs: Run-ASim-Sample-Data-Ingest
137304
name: Run ASim Schema and Data tests
138305
runs-on: ubuntu-latest
306+
permissions:
307+
id-token: write
308+
contents: read
139309
steps:
140310
- name: Checkout pull request branch
141311
uses: actions/checkout@v3
142312
with:
143-
ref: ${{ github.event.pull_request.head.ref }}
313+
ref: ${{ github.event.pull_request.head.sha }}
144314
repository: ${{ github.event.pull_request.head.repo.full_name }}
145315
persist-credentials: false
146316
fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
@@ -197,11 +367,14 @@ jobs:
197367
needs: Run-ASim-Sample-Data-Ingest
198368
name: Run ASim Parser Filtering tests
199369
runs-on: ubuntu-latest
370+
permissions:
371+
id-token: write
372+
contents: read
200373
steps:
201374
- name: Checkout pull request branch
202375
uses: actions/checkout@v3
203376
with:
204-
ref: ${{ github.event.pull_request.head.ref }}
377+
ref: ${{ github.event.pull_request.head.sha }}
205378
repository: ${{ github.event.pull_request.head.repo.full_name }}
206379
persist-credentials: false # otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token.
207380
fetch-depth: 0 # otherwise, there would be errors pushing refs to the destination repository.
@@ -246,4 +419,4 @@ jobs:
246419
echo "Downloading script from the master: $url"
247420
curl -o "$filePath" "$url"
248421
# Execute the script
249-
python "$filePath"
422+
python "$filePath"

0 commit comments

Comments
 (0)