Skip to content

Commit 4824fc0

Browse files
witmickowitmicko
authored
Merge pull request #72 from MetaMask/onboarding-automation
feat: add SAST onboarding automation
2 parents 1cdbc3b + d7f3893 commit 4824fc0

File tree

6 files changed

+492
-0
lines changed

6 files changed

+492
-0
lines changed

‎.github/templates/README.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# PR Body Templates
2+
3+
This directory contains templates for onboarding PRs that add the Security Code Scanner to repositories.
4+
5+
## Templates
6+
7+
### `onboarding-pr-body-manual.md`
8+
9+
**Use for:** Manual PRs created by the security team
10+
11+
- More detailed with full language configuration examples
12+
- Includes code snippets for common scenarios
13+
- Comprehensive documentation
14+
- No auto-merge disclaimer
15+
16+
### `onboarding-pr-body-automated.md`
17+
18+
**Use for:** Automated PRs created by workflows
19+
20+
- Shorter, more concise
21+
- Includes auto-merge warning at the top
22+
- Links to README for detailed configuration
23+
- Used by `.github/workflows/onboard-new-repo.yml`
24+
25+
## Variables
26+
27+
Both templates support variable substitution:
28+
29+
- `{{SECURITY_SCANNING_URL}}` - Repository-specific code scanning alerts URL
30+
31+
## Usage
32+
33+
**Manual PRs:**
34+
35+
```bash
36+
# Copy and paste from onboarding-pr-body-manual.md
37+
# Replace {{SECURITY_SCANNING_URL}} with actual URL
38+
```
39+
40+
**Automated workflow:**
41+
The workflow automatically reads `onboarding-pr-body-automated.md` and substitutes variables.

‎.github/templates/onboarding-pr-body-automated.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
## ⚠️ Important Notice - Action Required
2+
3+
**This PR may be auto-merged in the future if not configured.**
4+
5+
If your team does not need the security scanner:
6+
7+
1. **Add a comment on this PR** explaining why your team is opting out
8+
2. **Close this PR** to prevent auto-merge
9+
3. **Add a `.github/no-security-scanner` file** to your repository to prevent future onboarding attempts
10+
11+
If you need the scanner but want to customize it:
12+
13+
1. Complete the checklist below
14+
2. Review and modify the workflow file as needed
15+
3. Approve and merge this PR when ready
16+
17+
If no action is taken, this PR may be automatically merged after a grace period to ensure baseline security coverage across all repositories.
18+
19+
---
20+
21+
## Required Action
22+
23+
Prior to merging this pull request, please ensure the following has been completed:
24+
25+
- [ ] The lines specifying `branches` correctly specify this repository's default branch (usually `main` or `master`).
26+
- [ ] Any paths you would like to ignore have been added to the `paths-ignored` configuration option (see [setup](https://github.com/MetaMask/action-security-code-scanner/blob/main/README.md#setup))
27+
- [ ] Language configuration has been reviewed - ignore falsely detected languages or add build commands for Java/Kotlin if needed (see Configuration section below)
28+
- [ ] Any existing CodeQL configuration has been disabled.
29+
30+
## What is the Security Code Scanner?
31+
32+
This pull request enables the [MetaMask Security Code Scanner](https://github.com/MetaMask/action-security-code-scanner) GitHub Action. This action runs on each pull request, and will flag potential vulnerabilities as a review comment. It will also scan this repository's default branch, and log any findings in this repository's [Code Scanning Alerts Tab]({{SECURITY_SCANNING_URL}}).
33+
34+
<img width="500" alt="Security Scanner Screenshot" src="https://github.com/user-attachments/assets/41c87b70-79b7-44dd-a444-791b142fbbe1">
35+
36+
The action itself runs various static analysis engines behind the scenes. Currently, it is only running GitHub's CodeQL engine. For this reason, we recommend disabling any existing CodeQL configuration your repository may have.
37+
38+
## How do I interact with the tool?
39+
40+
Every finding raised by the Security Code Scanner will present context behind the potential vulnerability identified, and allow the developer to fix, or dismiss it.
41+
42+
The finding will automatically be dismissed by pushing a commit that fixes the identified issue, or by manually dismissing the alert using the button in GitHub's UI. If dismissing an alert manually, please add any additional context surrounding the reason for dismissal, as this informs our decision to disable, or improve any poor performing rules.
43+
44+
<img width="983" alt="Alert Dismissal Screenshot" src="https://github.com/user-attachments/assets/114219d5-4b4c-4d9d-8bfe-f4666012b73e">
45+
46+
## Configuration
47+
48+
### Language Configuration
49+
50+
The scanner auto-detects languages in your repository. If you need to customize language-specific settings, you can modify the `languages-config` section in the workflow file.
51+
52+
**Common use cases:**
53+
54+
1. **Ignore falsely detected languages:**
55+
56+
```yaml
57+
languages-config: |
58+
[
59+
{
60+
"language": "ruby",
61+
"ignore": true
62+
}
63+
]
64+
```
65+
66+
2. **Configure Java/Kotlin builds:**
67+
68+
```yaml
69+
languages-config: |
70+
[
71+
{
72+
"language": "java-kotlin",
73+
"build_mode": "manual",
74+
"build_command": "./gradlew build",
75+
"version": "21",
76+
"distribution": "temurin"
77+
}
78+
]
79+
```
80+
81+
**Supported languages:** `javascript-typescript`, `python`, `java-kotlin`, `go`, `cpp`, `csharp`, `ruby`
82+
83+
**Build modes:** `none`, `autobuild`, `manual`
84+
85+
### Additional Configuration
86+
87+
For more configuration options, please review the tool's [README](https://github.com/MetaMask/action-security-code-scanner/blob/main/README.md).
88+
89+
For any additional questions, please reach out to `@app-sec` in Slack.
90+
91+
---
92+
93+
🤖 _This PR was automatically created by the MetaMask Security onboarding system_

‎.github/templates/security-code-scanner.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: MetaMask Security Code Scanner
2+
3+
on:
4+
push:
5+
branches:
6+
- { DEFAULT_BRANCH }
7+
pull_request:
8+
branches:
9+
- { DEFAULT_BRANCH }
10+
workflow_call:
11+
secrets:
12+
SECURITY_SCAN_METRICS_TOKEN:
13+
required: false
14+
APPSEC_BOT_SLACK_WEBHOOK:
15+
required: false
16+
workflow_dispatch:
17+
18+
jobs:
19+
security-scan:
20+
uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@v2
21+
permissions:
22+
actions: read
23+
contents: read
24+
security-events: write
25+
with:
26+
repo: ${{ github.repository }}
27+
scanner-ref: 'v2'
28+
paths-ignored: |
29+
node_modules
30+
**/node_modules/**
31+
**/__snapshots__/**
32+
__snapshots_linux__
33+
**/__stories__/**
34+
.storybook/
35+
**/*.test.ts
36+
**/*.test.tsx
37+
**/*.test.js
38+
**/*.test.jsx
39+
**/*.spec.ts
40+
**/*.spec.tsx
41+
**/*.spec.js
42+
**/*.spec.jsx
43+
**/test*/**
44+
**/e2e/**
45+
**/tests/**
46+
languages-config: |
47+
[
48+
]
49+
secrets:
50+
project-metrics-token: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
51+
slack-webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}

0 commit comments

Comments
 (0)