Skip to content

Commit 1de0b10

Browse files
feaselklfeaselkl
committed
Fix typos
1 parent 819aa13 commit 1de0b10

File tree

2 files changed

+166
-166
lines changed

2 files changed

+166
-166
lines changed

‎Solution/Exercise-03/Task-3/dotnet-deploy-2.yml

Lines changed: 63 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,63 @@
1-
name: .NET CI
2-
3-
env:
4-
registryName: {your_registry_name}.azurecr.io
5-
repositoryName: techexcel/dotnetcoreapp
6-
dockerFolderPath: ./Application/src/RazorPagesTestSample
7-
tag: ${{github.run_number}}
8-
9-
on:
10-
push:
11-
branches: [ main ]
12-
paths: src/Application/**
13-
pull_request:
14-
branches: [ main ]
15-
paths: src/Application/**
16-
# Allows you to run this workflow manually from the Actions tab
17-
workflow_dispatch:
18-
jobs:
19-
build:
20-
21-
runs-on: ubuntu-latest
22-
23-
steps:
24-
- uses: actions/checkout@v3
25-
- name: Setup .NET
26-
uses: actions/setup-dotnet@v3
27-
with:
28-
dotnet-version: 8.0
29-
30-
- name: Restore dependencies
31-
run: dotnet restore ./src/Application/src/RazorPagesTestSample/RazorPagesTestSample.csproj
32-
- name: Build
33-
run: dotnet build --no-restore ./src/Application/src/RazorPagesTestSample/RazorPagesTestSample.csproj
34-
- name: Test
35-
run: dotnet test --no-build --verbosity normal ./src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj
36-
37-
dockerBuildPush:
38-
39-
runs-on: ubuntu-latest
40-
needs: build
41-
42-
steps:
43-
- uses: actions/checkout@v3
44-
45-
- name: Docker Login
46-
# You may pin to the exact commit or the version.
47-
# uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
48-
uses: docker/[email protected]
49-
with:
50-
# Server address of Docker registry. If not set then will default to Docker Hub
51-
registry: ${{ secrets.ACR_LOGIN_SERVER }}
52-
# Username used to log against the Docker registry
53-
username: ${{ secrets.ACR_USERNAME }}
54-
# Password or personal access token used to log against the Docker registry
55-
password: ${{ secrets.ACR_PASSWORD }}
56-
# Log out from the Docker registry at the end of a job
57-
logout: true
58-
59-
- name: Docker Build
60-
run: docker build -t $registryName/$repositoryName:$tag --build-arg build_version=$tag $dockerFolderPath
61-
62-
- name: Docker Push
63-
run: docker push $registryName/$repositoryName:$tag
1+
name: .NET CI
2+
3+
env:
4+
registryName: {your_registry_name}.azurecr.io
5+
repositoryName: techexcel/dotnetcoreapp
6+
dockerFolderPath: ./src/Application/src/RazorPagesTestSample
7+
tag: ${{github.run_number}}
8+
9+
on:
10+
push:
11+
branches: [ main ]
12+
paths: src/Application/**
13+
pull_request:
14+
branches: [ main ]
15+
paths: src/Application/**
16+
# Allows you to run this workflow manually from the Actions tab
17+
workflow_dispatch:
18+
jobs:
19+
build:
20+
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- uses: actions/checkout@v3
25+
- name: Setup .NET
26+
uses: actions/setup-dotnet@v3
27+
with:
28+
dotnet-version: 8.0
29+
30+
- name: Restore dependencies
31+
run: dotnet restore ./src/Application/src/RazorPagesTestSample/RazorPagesTestSample.csproj
32+
- name: Build
33+
run: dotnet build --no-restore ./src/Application/src/RazorPagesTestSample/RazorPagesTestSample.csproj
34+
- name: Test
35+
run: dotnet test --no-build --verbosity normal ./src/Application/tests/RazorPagesTestSample.Tests/RazorPagesTestSample.Tests.csproj
36+
37+
dockerBuildPush:
38+
39+
runs-on: ubuntu-latest
40+
needs: build
41+
42+
steps:
43+
- uses: actions/checkout@v3
44+
45+
- name: Docker Login
46+
# You may pin to the exact commit or the version.
47+
# uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
48+
uses: docker/[email protected]
49+
with:
50+
# Server address of Docker registry. If not set then will default to Docker Hub
51+
registry: ${{ secrets.ACR_LOGIN_SERVER }}
52+
# Username used to log against the Docker registry
53+
username: ${{ secrets.ACR_USERNAME }}
54+
# Password or personal access token used to log against the Docker registry
55+
password: ${{ secrets.ACR_PASSWORD }}
56+
# Log out from the Docker registry at the end of a job
57+
logout: true
58+
59+
- name: Docker Build
60+
run: docker build -t $registryName/$repositoryName:$tag --build-arg build_version=$tag $dockerFolderPath
61+
62+
- name: Docker Push
63+
run: docker push $registryName/$repositoryName:$tag

‎docs/04_make_things_secure/0401.md

Lines changed: 103 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -1,103 +1,103 @@
1-
---
2-
title: '1. Implement GitHub Advanced Security'
3-
layout: default
4-
nav_order: 1
5-
parent: 'Exercise 04: Make things secure'
6-
---
7-
8-
# Task 01 - Implement GitHub Advanced Security (20 minutes)
9-
10-
## Introduction
11-
12-
The Munson's Pickles and Preserves Team Messaging System is up and running! They even have a proper Git Flow to protect against unintended changes to the main branch, and are recording application telemetry into App Insights. Before we are truly production-ready, though, there is one topic we have to cover: security.
13-
14-
One good DevOps practice is to enable protections against code-level vulnerabilities, and GitHub provides a number of useful features in this area. First, there are Issues, which allow developers or users to open 'tickets' indicating bugs to be fixed or potential vulnerabilities. If your organization prefers security flaws to be reported in a location other than GitHub, you have the option to provide a custom Security policy which describes the process for reporting.
15-
16-
In addition to these manual processes, GitHub also provides automated tools for scanning code for common errors. In this task, you will utilize the built-in Dependabot, which provides alerts if your repository contains libraries, packages, or external dependencies with known vulnerabilities. You will also set up a workflow with CodeQL, which can scan your source code for common coding errors or basic security flaws. This will help to ensure that the Team Messaging System contains code without any known vulnerabilities.
17-
18-
## Description
19-
20-
In this task, you will enable some of GitHub's built-in tools for securing code in repositories.
21-
22-
1. Ask GitHub Copilot, "What do I need in a GitHub repository's security file?"
23-
2. Find the repository's Security policy. If there is an existing policy, make an edit using GithUb Copilot and merge your change back into the main branch. Otherwise, create a policy using the template provided and GitHub Copilot. GitHub Security policies are Markdown documents that indicate the preferred way to report security vulnerabilities for the repository.
24-
3. Ask GitHub Copilot, "How do I enable Dependabot alerts on a GitHub repository?" Then, enable Dependabot alerts for the repository. Dependabot is an automated tool that creates a pull request when any dependencies in the code base has a known vulnerability.
25-
4. Ask GitHub Copilot, "How do I create a code scanning workflow in a GitHub repository?" After that, set up and run a Code scanning workflow for the repository using GitHub's 'CodeQL Analysis.' This workflow can run either on each pull request or on a schedule, and it checks your code for common vulnerabilities or errors.
26-
5. Ask GitHub Copilot, "How can I view the results of a CodeQL analysis in GitHub?" Then, navigate to the results. The next task will cover reviewing and correcting any issues you find.
27-
6. Ask GitHub Copilot, "How do I enable secret scanning on a GitHub repository?" Then, enable secret scanning and push protection on the repository.
28-
29-
## Success Criteria
30-
31-
- The **Security** page for your GitHub repository shows that Dependabot alerts, Code scanning alerts, and Secret scanning alerts are all enabled.
32-
- You have one Dependabot alert, one Code scanning alert, and one Secret scanning alert.
33-
34-
## Learning Resources
35-
36-
- [Learn more about adding a security policy to your repository](https://docs.github.com/en/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository).
37-
- [Learn more about Dependabot and vulnerable dependencies](https://docs.github.com/en/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies).
38-
- [Learn more about automated code scanning and understanding results](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code).
39-
40-
## Tips
41-
42-
- If you are stuck, check out the **Security** tab of your repository on GitHub.
43-
44-
## Solution
45-
46-
<details markdown="block">
47-
<summary>Expand this section to view the solution</summary>
48-
49-
1. Select **Settings** in your repo, then **Code security and analysis**. Select **Enable** on "Dependabot alerts" and "Dependabot security updates."
50-
51-
![Enabled Dependabot alerts and security updates](../../Media/EnableDependabot.png)
52-
53-
**Note** This will also automatically enable "Dependency graph."
54-
2. Navigate to [https://github.com/electron/electron/blob/main/SECURITY.md](https://github.com/electron/electron/blob/main/SECURITY.md) for information about security policies. This is an example of a sample security policy that you could use for this exercise.
55-
3. In your GitHub repo, select **Security**, **Policy**, and **Start setup**
56-
57-
![Start the security policy setup](../../Media/StartSecurityPolicySetup.png)
58-
59-
4. Paste the security policy into the Markdown file (you can overwrite what is there now) and update it for the Munson's Pickles and Preserves Team Messaging System and the GitHub repo your code is in. Then, commit the changes to the main branch.
60-
61-
![Commit the updated security policy](../../Media/CommitSecurityPolicy.png)
62-
63-
5. Next, we need to enable CodeQL. Select **Settings** and then **Code security and analysis**.
64-
6. Scroll down if needed and select **Set up** in "Code scanning" for "CodeQL analysis."
65-
66-
![Setup CodeQL analysis](../../Media/CodeQLAnalysisSetup.png)
67-
68-
7. If you select "Default", the code scan will immediately be run. For this exercise, select **Advanced**.
69-
70-
![Select Default](../../Media/CodeQLAdvanced.png)
71-
72-
8. By choosing the advanced option, you can see the YAML for the pipeline that actually performs the code check. We don't need to make any changes here, but it's something you should be familiar with. An easy change to make in this file would be if you want to adjust the schedule of when the scan runs. Use GitHub Copilot to assist you with making any change.
73-
74-
![Commit the CodeQL YAML](../../Media/CodeQLYAMLCommit.png)
75-
76-
After you've reviewed the YAML, commit the change to main.
77-
78-
![Commit the change](../../Media/CodeQLCommitChange.png)
79-
80-
9. After you've committed the change, select **Actions** and you should see your CodeQL Scan workflow running.
81-
82-
![CodeQL scan running](../../Media/CodeQLScanRunning.png)
83-
84-
10. After about 5 minutes, you should see the workflow has completed.
85-
86-
![Workflow complete](../../Media/CodeQLWorkflowComplete.png)
87-
88-
11. After it's complete, go back to **Settings** and **Code security and analysis**. Then, select the ellipsis **...** next to the "Set up" menu. From the ellipsis dropdown, explore each of the first two options: "View last scan log" and "View Code Scanning alerts." You will find one High-risk vulnerability around arbitrary file access during archive extraction.
89-
90-
{: .note }
91-
> This page will still show "Set up" because we chose the Advanced option instead of Basic.
92-
93-
![View code scanning results](../../Media/CodeQLViewResults.png)
94-
95-
12. Return to the **Settings** menu and select **Code security and analysis**. Navigate to the bottom of the page and select the **Enable** button for Secret scanning.
96-
97-
![Enable secret scanning](../../Media/0401_SecretScanning.png)
98-
99-
Once you have enabled secret scanning, you will be able to enable a second option for Push protection.
100-
101-
![Enable push protection](../../Media/0401_PushProtection.png)
102-
103-
</details>
1+
---
2+
title: '1. Implement GitHub Advanced Security'
3+
layout: default
4+
nav_order: 1
5+
parent: 'Exercise 04: Make things secure'
6+
---
7+
8+
# Task 01 - Implement GitHub Advanced Security (20 minutes)
9+
10+
## Introduction
11+
12+
The Munson's Pickles and Preserves Team Messaging System is up and running! They even have a proper Git Flow to protect against unintended changes to the main branch, and are recording application telemetry into App Insights. Before we are truly production-ready, though, there is one topic we have to cover: security.
13+
14+
One good DevOps practice is to enable protections against code-level vulnerabilities, and GitHub provides a number of useful features in this area. First, there are Issues, which allow developers or users to open 'tickets' indicating bugs to be fixed or potential vulnerabilities. If your organization prefers security flaws to be reported in a location other than GitHub, you have the option to provide a custom Security policy which describes the process for reporting.
15+
16+
In addition to these manual processes, GitHub also provides automated tools for scanning code for common errors. In this task, you will utilize the built-in Dependabot, which provides alerts if your repository contains libraries, packages, or external dependencies with known vulnerabilities. You will also set up a workflow with CodeQL, which can scan your source code for common coding errors or basic security flaws. This will help to ensure that the Team Messaging System contains code without any known vulnerabilities.
17+
18+
## Description
19+
20+
In this task, you will enable some of GitHub's built-in tools for securing code in repositories.
21+
22+
1. Ask GitHub Copilot, "What do I need in a GitHub repository's security file?"
23+
2. Find the repository's Security policy. If there is an existing policy, make an edit using GitHub Copilot and merge your change back into the main branch. Otherwise, create a policy using the template provided and GitHub Copilot. GitHub Security policies are Markdown documents that indicate the preferred way to report security vulnerabilities for the repository.
24+
3. Ask GitHub Copilot, "How do I enable Dependabot alerts on a GitHub repository?" Then, enable Dependabot alerts for the repository. Dependabot is an automated tool that creates a pull request when any dependencies in the code base has a known vulnerability.
25+
4. Ask GitHub Copilot, "How do I create a code scanning workflow in a GitHub repository?" After that, set up and run a Code scanning workflow for the repository using GitHub's 'CodeQL Analysis.' This workflow can run either on each pull request or on a schedule, and it checks your code for common vulnerabilities or errors.
26+
5. Ask GitHub Copilot, "How can I view the results of a CodeQL analysis in GitHub?" Then, navigate to the results. The next task will cover reviewing and correcting any issues you find.
27+
6. Ask GitHub Copilot, "How do I enable secret scanning on a GitHub repository?" Then, enable secret scanning and push protection on the repository.
28+
29+
## Success Criteria
30+
31+
- The **Security** page for your GitHub repository shows that Dependabot alerts, Code scanning alerts, and Secret scanning alerts are all enabled.
32+
- You have one Dependabot alert, one Code scanning alert, and one Secret scanning alert.
33+
34+
## Learning Resources
35+
36+
- [Learn more about adding a security policy to your repository](https://docs.github.com/en/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository).
37+
- [Learn more about Dependabot and vulnerable dependencies](https://docs.github.com/en/github/managing-security-vulnerabilities/managing-vulnerabilities-in-your-projects-dependencies).
38+
- [Learn more about automated code scanning and understanding results](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code).
39+
40+
## Tips
41+
42+
- If you are stuck, check out the **Security** tab of your repository on GitHub.
43+
44+
## Solution
45+
46+
<details markdown="block">
47+
<summary>Expand this section to view the solution</summary>
48+
49+
1. Select **Settings** in your repo, then **Code security and analysis**. Select **Enable** on "Dependabot alerts" and "Dependabot security updates."
50+
51+
![Enabled Dependabot alerts and security updates](../../Media/EnableDependabot.png)
52+
53+
**Note** This will also automatically enable "Dependency graph."
54+
2. Navigate to [https://github.com/electron/electron/blob/main/SECURITY.md](https://github.com/electron/electron/blob/main/SECURITY.md) for information about security policies. This is an example of a sample security policy that you could use for this exercise.
55+
3. In your GitHub repo, select **Security**, **Policy**, and **Start setup**
56+
57+
![Start the security policy setup](../../Media/StartSecurityPolicySetup.png)
58+
59+
4. Paste the security policy into the Markdown file (you can overwrite what is there now) and update it for the Munson's Pickles and Preserves Team Messaging System and the GitHub repo your code is in. Then, commit the changes to the main branch.
60+
61+
![Commit the updated security policy](../../Media/CommitSecurityPolicy.png)
62+
63+
5. Next, we need to enable CodeQL. Select **Settings** and then **Code security and analysis**.
64+
6. Scroll down if needed and select **Set up** in "Code scanning" for "CodeQL analysis."
65+
66+
![Setup CodeQL analysis](../../Media/CodeQLAnalysisSetup.png)
67+
68+
7. If you select "Default", the code scan will immediately be run. For this exercise, select **Advanced**.
69+
70+
![Select Default](../../Media/CodeQLAdvanced.png)
71+
72+
8. By choosing the advanced option, you can see the YAML for the pipeline that actually performs the code check. We don't need to make any changes here, but it's something you should be familiar with. An easy change to make in this file would be if you want to adjust the schedule of when the scan runs. Use GitHub Copilot to assist you with making any change.
73+
74+
![Commit the CodeQL YAML](../../Media/CodeQLYAMLCommit.png)
75+
76+
After you've reviewed the YAML, commit the change to main.
77+
78+
![Commit the change](../../Media/CodeQLCommitChange.png)
79+
80+
9. After you've committed the change, select **Actions** and you should see your CodeQL Scan workflow running.
81+
82+
![CodeQL scan running](../../Media/CodeQLScanRunning.png)
83+
84+
10. After about 5 minutes, you should see the workflow has completed.
85+
86+
![Workflow complete](../../Media/CodeQLWorkflowComplete.png)
87+
88+
11. After it's complete, go back to **Settings** and **Code security and analysis**. Then, select the ellipsis **...** next to the "Set up" menu. From the ellipsis dropdown, explore each of the first two options: "View last scan log" and "View Code Scanning alerts." You will find one High-risk vulnerability around arbitrary file access during archive extraction.
89+
90+
{: .note }
91+
> This page will still show "Set up" because we chose the Advanced option instead of Basic.
92+
93+
![View code scanning results](../../Media/CodeQLViewResults.png)
94+
95+
12. Return to the **Settings** menu and select **Code security and analysis**. Navigate to the bottom of the page and select the **Enable** button for Secret scanning.
96+
97+
![Enable secret scanning](../../Media/0401_SecretScanning.png)
98+
99+
Once you have enabled secret scanning, you will be able to enable a second option for Push protection.
100+
101+
![Enable push protection](../../Media/0401_PushProtection.png)
102+
103+
</details>

0 commit comments

Comments
 (0)