Skip to content

Commit 99a54cf

Browse files
h4x3rotabh4x3rotab
committed
simplify checks
1 parent f280851 commit 99a54cf

File tree

3 files changed

+27
-173
lines changed

3 files changed

+27
-173
lines changed

‎.actrc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
-P ubuntu-latest=catthehacker/ubuntu:act-latest
2+
--container-architecture linux/amd64

‎.github/workflows/security-scan.yml‎

Lines changed: 16 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ on:
1010
- cron: '0 2 * * 1'
1111

1212
jobs:
13-
basic-security-checks:
13+
basic-checks:
1414
runs-on: ubuntu-latest
15-
name: Basic Security Checks
15+
name: Basic Checks (dev.sh)
1616
steps:
1717
- uses: actions/checkout@v4
1818

@@ -25,12 +25,16 @@ jobs:
2525
# Install yamllint
2626
pip install yamllint
2727
28-
- name: Run dev.sh security checks
29-
run: ./dev.sh security
28+
- name: Run all checks
29+
run: ./dev.sh check-all
3030

31-
secret-scan:
31+
advanced-security:
3232
runs-on: ubuntu-latest
33-
name: Secret Detection
33+
name: Advanced Security Scans
34+
permissions:
35+
actions: read
36+
contents: read
37+
security-events: write
3438
steps:
3539
- uses: actions/checkout@v4
3640
with:
@@ -44,46 +48,6 @@ jobs:
4448
head: HEAD
4549
extra_args: --debug --only-verified
4650

47-
dependency-scan:
48-
runs-on: ubuntu-latest
49-
name: Dependency Vulnerability Scan
50-
steps:
51-
- uses: actions/checkout@v4
52-
53-
- name: Scan for vulnerable dependencies
54-
run: |
55-
echo "Scanning for vulnerable dependencies..."
56-
57-
# Find all package.json files
58-
find . -name "package.json" -not -path "./node_modules/*" | while read -r package_file; do
59-
echo "Scanning: $package_file"
60-
dir=$(dirname "$package_file")
61-
62-
if command -v npm >/dev/null 2>&1; then
63-
cd "$dir"
64-
npm audit --audit-level=high || echo "❌ Vulnerabilities found in $package_file"
65-
cd - > /dev/null
66-
fi
67-
done
68-
69-
# Find all requirements.txt files
70-
find . -name "requirements.txt" -not -path "./venv/*" | while read -r req_file; do
71-
echo "Found Python requirements: $req_file"
72-
echo "⚠️ Consider using 'pip-audit' for Python dependency scanning"
73-
done
74-
75-
# Find all go.mod files
76-
find . -name "go.mod" | while read -r go_file; do
77-
echo "Found Go module: $go_file"
78-
echo "⚠️ Consider using 'nancy' or 'govulncheck' for Go dependency scanning"
79-
done
80-
81-
dockerfile-scan:
82-
runs-on: ubuntu-latest
83-
name: Dockerfile Security Scan
84-
steps:
85-
- uses: actions/checkout@v4
86-
8751
- name: Run Hadolint
8852
uses: hadolint/[email protected]
8953
with:
@@ -98,16 +62,6 @@ jobs:
9862
with:
9963
sarif_file: hadolint-results.sarif
10064

101-
code-security:
102-
runs-on: ubuntu-latest
103-
name: Code Security Analysis
104-
permissions:
105-
actions: read
106-
contents: read
107-
security-events: write
108-
steps:
109-
- uses: actions/checkout@v4
110-
11165
- name: Initialize CodeQL
11266
uses: github/codeql-action/init@v2
11367
with:
@@ -122,28 +76,9 @@ jobs:
12276
with:
12377
category: "/language:javascript,python,go"
12478

125-
comprehensive-security:
126-
runs-on: ubuntu-latest
127-
if: github.event_name == 'schedule'
128-
name: Comprehensive Security Check
129-
steps:
130-
- uses: actions/checkout@v4
131-
132-
- name: Install dependencies
133-
run: |
134-
# Install shellcheck
135-
sudo apt-get update
136-
sudo apt-get install -y shellcheck
137-
138-
# Install yamllint
139-
pip install yamllint
140-
141-
- name: Run all checks
142-
run: ./dev.sh check-all
143-
14479
security-summary:
14580
runs-on: ubuntu-latest
146-
needs: [basic-security-checks, secret-scan, dependency-scan, dockerfile-scan, code-security]
81+
needs: [basic-checks, advanced-security]
14782
if: always()
14883
name: Security Summary
14984

@@ -154,23 +89,17 @@ jobs:
15489
echo "" >> $GITHUB_STEP_SUMMARY
15590
15691
# Check job results
157-
basic_result="${{ needs.basic-security-checks.result }}"
158-
secret_result="${{ needs.secret-scan.result }}"
159-
dependency_result="${{ needs.dependency-scan.result }}"
160-
dockerfile_result="${{ needs.dockerfile-scan.result }}"
161-
code_result="${{ needs.code-security.result }}"
92+
basic_result="${{ needs.basic-checks.result }}"
93+
advanced_result="${{ needs.advanced-security.result }}"
16294
16395
echo "| Security Check | Status |" >> $GITHUB_STEP_SUMMARY
16496
echo "|----------------|--------|" >> $GITHUB_STEP_SUMMARY
165-
echo "| Basic Security | $basic_result |" >> $GITHUB_STEP_SUMMARY
166-
echo "| Secret Detection | $secret_result |" >> $GITHUB_STEP_SUMMARY
167-
echo "| Dependency Scan | $dependency_result |" >> $GITHUB_STEP_SUMMARY
168-
echo "| Dockerfile Scan | $dockerfile_result |" >> $GITHUB_STEP_SUMMARY
169-
echo "| Code Analysis | $code_result |" >> $GITHUB_STEP_SUMMARY
97+
echo "| Basic Checks (dev.sh) | $basic_result |" >> $GITHUB_STEP_SUMMARY
98+
echo "| Advanced Security | $advanced_result |" >> $GITHUB_STEP_SUMMARY
17099
echo "" >> $GITHUB_STEP_SUMMARY
171100
172101
# Overall status
173-
if [[ "$basic_result $secret_result $dependency_result $dockerfile_result $code_result" == *"failure"* ]]; then
102+
if [[ "$basic_result $advanced_result" == *"failure"* ]]; then
174103
echo "🔴 **Security issues detected!** Please review the scan results." >> $GITHUB_STEP_SUMMARY
175104
else
176105
echo "🟢 **All security scans passed successfully.**" >> $GITHUB_STEP_SUMMARY

‎.github/workflows/validate-examples.yml‎

Lines changed: 9 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -10,69 +10,8 @@ on:
1010
- cron: '0 0 * * 0'
1111

1212
jobs:
13-
detect-changes:
13+
check-all:
1414
runs-on: ubuntu-latest
15-
outputs:
16-
examples: ${{ steps.changes.outputs.examples }}
17-
steps:
18-
- uses: actions/checkout@v4
19-
with:
20-
fetch-depth: 0
21-
22-
- name: Detect changed examples
23-
id: changes
24-
run: |
25-
if [ "${{ github.event_name }}" == "schedule" ]; then
26-
# For scheduled runs, test all examples
27-
examples=$(./dev.sh list | grep -E "^ - " | sed 's/^ - //' | jq -R -s -c 'split("\n")[:-1]')
28-
else
29-
# For PR/push, only test changed examples
30-
changed_files=$(git diff --name-only ${{ github.event.before }}..${{ github.sha }} || git diff --name-only HEAD~1)
31-
examples=$(echo "$changed_files" | grep -E "(docker-compose\.ya?ml|Dockerfile|\.sh)$" | xargs dirname 2>/dev/null | sort -u | jq -R -s -c 'split("\n")[:-1]' || echo '[]')
32-
fi
33-
echo "examples=$examples" >> $GITHUB_OUTPUT
34-
35-
validate-examples:
36-
runs-on: ubuntu-latest
37-
needs: detect-changes
38-
if: needs.detect-changes.outputs.examples != '[]'
39-
strategy:
40-
matrix:
41-
example: ${{ fromJson(needs.detect-changes.outputs.examples) }}
42-
fail-fast: false
43-
44-
steps:
45-
- uses: actions/checkout@v4
46-
47-
- name: Validate example
48-
run: |
49-
example="${{ matrix.example }}"
50-
echo "Validating: $example"
51-
./dev.sh validate "$example"
52-
53-
lint-and-security:
54-
runs-on: ubuntu-latest
55-
steps:
56-
- uses: actions/checkout@v4
57-
58-
- name: Install dependencies
59-
run: |
60-
# Install shellcheck
61-
sudo apt-get update
62-
sudo apt-get install -y shellcheck
63-
64-
# Install yamllint
65-
pip install yamllint
66-
67-
- name: Run lint checks
68-
run: ./dev.sh lint
69-
70-
- name: Run security checks
71-
run: ./dev.sh security
72-
73-
comprehensive-check:
74-
runs-on: ubuntu-latest
75-
if: github.event_name == 'schedule'
7615
steps:
7716
- uses: actions/checkout@v4
7817

@@ -88,30 +27,14 @@ jobs:
8827
- name: Run all checks
8928
run: ./dev.sh check-all
9029

91-
summary:
92-
runs-on: ubuntu-latest
93-
needs: [detect-changes, validate-examples, lint-and-security]
94-
if: always()
95-
96-
steps:
97-
- name: Validation Summary
30+
- name: Create summary
31+
if: always()
9832
run: |
9933
echo "## Validation Summary" >> $GITHUB_STEP_SUMMARY
10034
echo "" >> $GITHUB_STEP_SUMMARY
101-
102-
examples="${{ needs.detect-changes.outputs.examples }}"
103-
if [ "$examples" == "[]" ] || [ "$examples" == "" ]; then
104-
echo "No examples were modified or detected for validation." >> $GITHUB_STEP_SUMMARY
105-
else
106-
echo "Validated examples: $examples" >> $GITHUB_STEP_SUMMARY
107-
echo "" >> $GITHUB_STEP_SUMMARY
108-
109-
# Check job results
110-
validation_result="${{ needs.validate-examples.result }}"
111-
lint_security_result="${{ needs.lint-and-security.result }}"
112-
113-
echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
114-
echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
115-
echo "| Example Validation | $validation_result |" >> $GITHUB_STEP_SUMMARY
116-
echo "| Lint & Security | $lint_security_result |" >> $GITHUB_STEP_SUMMARY
117-
fi
35+
echo "✅ Ran comprehensive checks including:" >> $GITHUB_STEP_SUMMARY
36+
echo "- Structure validation for all examples" >> $GITHUB_STEP_SUMMARY
37+
echo "- Docker Compose syntax validation" >> $GITHUB_STEP_SUMMARY
38+
echo "- Security scanning" >> $GITHUB_STEP_SUMMARY
39+
echo "- Shell script linting" >> $GITHUB_STEP_SUMMARY
40+
echo "- YAML linting" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)