Skip to content

Commit 89f2c4e

Browse files
witmickowitmicko
committed
feat: add onboarding automation for new repos
1 parent ec21c3e commit 89f2c4e

File tree

5 files changed

+323
-0
lines changed

5 files changed

+323
-0
lines changed

‎.github/templates/README.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# PR Body Templates
2+
3+
This directory contains templates for onboarding PRs that add the Security Code Scanner to repositories.
4+
5+
## Templates
6+
7+
### `onboarding-pr-body-manual.md`
8+
**Use for:** Manual PRs created by the security team
9+
10+
- More detailed with full language configuration examples
11+
- Includes code snippets for common scenarios
12+
- Comprehensive documentation
13+
- No auto-merge disclaimer
14+
15+
### `onboarding-pr-body-automated.md`
16+
**Use for:** Automated PRs created by workflows
17+
18+
- Shorter, more concise
19+
- Includes auto-merge warning at the top
20+
- Links to README for detailed configuration
21+
- Used by `.github/workflows/onboard-new-repo.yml`
22+
23+
## Variables
24+
25+
Both templates support variable substitution:
26+
27+
- `{{SECURITY_SCANNING_URL}}` - Repository-specific code scanning alerts URL
28+
29+
## Usage
30+
31+
**Manual PRs:**
32+
```bash
33+
# Copy and paste from onboarding-pr-body-manual.md
34+
# Replace {{SECURITY_SCANNING_URL}} with actual URL
35+
```
36+
37+
**Automated workflow:**
38+
The workflow automatically reads `onboarding-pr-body-automated.md` and substitutes variables.

‎.github/templates/onboarding-pr-body-automated.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## ⚠️ Important Notice - Action Required
2+
3+
**This PR may be auto-merged in the future if not configured.**
4+
5+
If your team does not need the security scanner:
6+
- Please **close this PR** and add a comment explaining why
7+
- Consider adding a `.github/no-security-scanner` file to opt-out permanently
8+
9+
If you need the scanner but want to customize it:
10+
- Complete the checklist below
11+
- Review and modify the workflow file as needed
12+
- Approve and merge this PR when ready
13+
14+
If no action is taken, this PR may be automatically merged after a grace period to ensure baseline security coverage across all repositories.
15+
16+
---
17+
18+
## Required Action
19+
20+
Prior to merging this pull request, please ensure the following has been completed:
21+
- [ ] The lines specifying `branches` correctly specifies this repository's default branch (usually `main` or `master`).
22+
- [ ] Any paths you would like to ignore have been added to the `paths-ignored` configuration option (see [setup](https://github.com/MetaMask/action-security-code-scanner/blob/main/README.md#setup))
23+
- [ ] Language configuration has been reviewed - ignore falsely detected languages or add build commands for Java/Kotlin if needed (see Configuration section below)
24+
- [ ] Any existing CodeQL configuration has been disabled.
25+
26+
## What is the Security Code Scanner?
27+
28+
This pull request enables the [MetaMask Security Code Scanner](https://github.com/MetaMask/action-security-code-scanner) GitHub Action. This action runs on each pull request, and will flag potential vulnerabilities as a review comment. It will also scan this repository's default branch, and log any findings in this repository's [Code Scanning Alerts Tab]({{SECURITY_SCANNING_URL}}).
29+
30+
<img width="500" alt="Security Scanner Screenshot" src="https://github.com/user-attachments/assets/41c87b70-79b7-44dd-a444-791b142fbbe1">
31+
32+
The action itself runs various static analysis engines behind the scenes. Currently, it is only running GitHub's CodeQL engine. For this reason, we recommend disabling any existing CodeQL configuration your repository may have.
33+
34+
## How do I interact with the tool?
35+
36+
Every finding raised by the Security Code Scanner will present context behind the potential vulnerability identified, and allow the developer to fix, or dismiss it.
37+
38+
The finding will automatically be dismissed by pushing a commit that fixes the identified issue, or by manually dismissing the alert using the button in GitHub's UI. If dismissing an alert manually, please add any additional context surrounding the reason for dismissal, as this informs our decision to disable, or improve any poor performing rules.
39+
40+
<img width="983" alt="Alert Dismissal Screenshot" src="https://github.com/user-attachments/assets/114219d5-4b4c-4d9d-8bfe-f4666012b73e">
41+
42+
## Configuration
43+
44+
The scanner auto-detects languages in your repository. If you need to customize settings (ignore falsely detected languages, add Java/Kotlin build commands), please review the `languages-config` section in the workflow file.
45+
46+
For detailed configuration examples and options, please review the tool's [README](https://github.com/MetaMask/action-security-code-scanner/blob/main/README.md).
47+
48+
For any questions, please reach out to `@app-sec` in Slack.
49+
50+
---
51+
🤖 *This PR was automatically created by the MetaMask Security onboarding system*

‎.github/templates/onboarding-pr-body-manual.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
## Required Action
2+
3+
Prior to merging this pull request, please ensure the following has been completed:
4+
- [ ] The lines specifying `branches` correctly specifies this repository's default branch (usually `main` or `master`).
5+
- [ ] Any paths you would like to ignore have been added to the `paths-ignored` configuration option (see [setup](https://github.com/MetaMask/action-security-code-scanner/blob/main/README.md#setup))
6+
- [ ] Language configuration has been reviewed - ignore falsely detected languages or add build commands for Java/Kotlin if needed (see Configuration section below)
7+
- [ ] Any existing CodeQL configuration has been disabled.
8+
9+
## What is the Security Code Scanner?
10+
11+
This pull request enables the [MetaMask Security Code Scanner](https://github.com/MetaMask/action-security-code-scanner) GitHub Action. This action runs on each pull request, and will flag potential vulnerabilities as a review comment. It will also scan this repository's default branch, and log any findings in this repository's [Code Scanning Alerts Tab]({{SECURITY_SCANNING_URL}}).
12+
13+
<img width="500" alt="Screenshot 2024-02-12 at 9 19 05 PM" src="https://github.com/user-attachments/assets/41c87b70-79b7-44dd-a444-791b142fbbe1">
14+
15+
The action itself runs various static analysis engines behind the scenes. Currently, it is only running GitHub's CodeQL engine. For this reason, we recommend disabling any existing CodeQL configuration your repository may have.
16+
17+
## How do I interact with the tool?
18+
19+
Every finding raised by the Security Code Scanner will present context behind the potential vulnerability identified, and allow the developer to fix, or dismiss it.
20+
21+
The finding will automatically be dismissed by pushing a commit that fixes the identified issue, or by manually dismissing the alert using the button in GitHub's UI. If dismissing an alert manually, please add any additional context surrounding the reason for dismissal, as this informs our decision to disable, or improve any poor performing rules.
22+
23+
<img width="983" alt="Screenshot 2024-02-12 at 8 41 46 PM" src="https://github.com/user-attachments/assets/114219d5-4b4c-4d9d-8bfe-f4666012b73e">
24+
25+
## Configuration
26+
27+
### Language Configuration
28+
29+
The scanner auto-detects languages in your repository. If you need to customize language-specific settings, you can modify the `languages-config` section in the workflow file.
30+
31+
**Common use cases:**
32+
33+
1. **Ignore falsely detected languages:**
34+
```yaml
35+
languages-config: |
36+
[
37+
{
38+
"language": "ruby",
39+
"ignore": true
40+
}
41+
]
42+
```
43+
44+
2. **Configure Java/Kotlin builds:**
45+
```yaml
46+
languages-config: |
47+
[
48+
{
49+
"language": "java-kotlin",
50+
"build_mode": "manual",
51+
"build_command": "./gradlew build",
52+
"version": "21",
53+
"distribution": "temurin"
54+
}
55+
]
56+
```
57+
58+
**Supported languages:** `javascript-typescript`, `python`, `java-kotlin`, `go`, `cpp`, `csharp`, `ruby`
59+
60+
**Build modes:** `none`, `autobuild`, `manual`
61+
62+
### Additional Configuration
63+
64+
For more configuration options, please review the tool's [README](https://github.com/MetaMask/action-security-code-scanner/blob/main/README.md).
65+
66+
Optional secrets that can be configured:
67+
- `SECURITY_SCAN_METRICS_TOKEN` - for metrics collection
68+
- `APPSEC_BOT_SLACK_WEBHOOK` - for Slack notifications
69+
70+
For any additional questions, please reach out to `@app-sec` in Slack.

‎.github/workflows/onboard-new-repo.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: 'Onboard New Repository with SAST'
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
repository:
7+
description: 'Repository to onboard (format: owner/repo)'
8+
required: true
9+
type: string
10+
base_branch:
11+
description: 'Base branch to create PR against'
12+
required: false
13+
default: 'main'
14+
type: string
15+
repository_dispatch:
16+
types: [new_repository_created]
17+
18+
jobs:
19+
create-sast-pr:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
23+
pull-requests: write
24+
steps:
25+
- name: Checkout scanner action repository
26+
uses: actions/checkout@v4
27+
with:
28+
path: scanner-repo
29+
30+
- name: Determine target repository
31+
id: target
32+
run: |
33+
if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
34+
echo "repository=${{ github.event.client_payload.repository }}" >> $GITHUB_OUTPUT
35+
echo "base_branch=${{ github.event.client_payload.base_branch || 'main' }}" >> $GITHUB_OUTPUT
36+
else
37+
echo "repository=${{ inputs.repository }}" >> $GITHUB_OUTPUT
38+
echo "base_branch=${{ inputs.base_branch }}" >> $GITHUB_OUTPUT
39+
fi
40+
shell: bash
41+
42+
- name: Checkout target repository
43+
uses: actions/checkout@v4
44+
with:
45+
repository: ${{ steps.target.outputs.repository }}
46+
token: ${{ secrets.GITHUB_TOKEN }}
47+
path: target-repo
48+
ref: ${{ steps.target.outputs.base_branch }}
49+
50+
- name: Create branch and add SAST workflow
51+
working-directory: target-repo
52+
run: |
53+
git config user.name "MetaMask Security Bot"
54+
git config user.email "[email protected]"
55+
56+
BRANCH_NAME="security/add-sast-scanner"
57+
git checkout -b "$BRANCH_NAME"
58+
59+
# Create .github/workflows directory if it doesn't exist
60+
mkdir -p .github/workflows
61+
62+
# Copy the security scanner workflow template
63+
cp ../scanner-repo/examples/security-code-scanner.yml .github/workflows/security-code-scanner.yml
64+
65+
git add .github/workflows/security-code-scanner.yml
66+
git commit -m "chore: add MetaMask Security Code Scanner workflow
67+
68+
This PR adds the MetaMask Security Code Scanner workflow to enable
69+
automated security scanning of the codebase.
70+
71+
The scanner will run on:
72+
- Push to main branch
73+
- Pull requests to main branch
74+
- Manual workflow dispatch
75+
76+
To configure the scanner for your repository's specific needs,
77+
please review the workflow file and adjust as necessary."
78+
79+
git push origin "$BRANCH_NAME"
80+
shell: bash
81+
82+
- name: Create Pull Request
83+
working-directory: target-repo
84+
env:
85+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
86+
REPO_NAME: ${{ steps.target.outputs.repository }}
87+
run: |
88+
# Extract owner and repo name for URL construction
89+
OWNER=$(echo "$REPO_NAME" | cut -d'/' -f1)
90+
REPO=$(echo "$REPO_NAME" | cut -d'/' -f2)
91+
BASE_BRANCH="${{ steps.target.outputs.base_branch }}"
92+
SECURITY_URL="https://github.com/${OWNER}/${REPO}/security/code-scanning"
93+
94+
# Read PR body template and substitute variables
95+
PR_BODY=$(cat ../scanner-repo/.github/templates/onboarding-pr-body-automated.md)
96+
PR_BODY="${PR_BODY//\{\{SECURITY_SCANNING_URL\}\}/$SECURITY_URL}"
97+
98+
gh pr create \
99+
--title "🔒 Add MetaMask Security Code Scanner" \
100+
--body "$PR_BODY" \
101+
--base "$BASE_BRANCH" \
102+
--head "security/add-sast-scanner"
103+
shell: bash
104+
105+
- name: Output PR URL
106+
working-directory: target-repo
107+
env:
108+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
109+
run: |
110+
PR_URL=$(gh pr view security/add-sast-scanner --json url -q .url)
111+
echo "✅ Pull Request created: $PR_URL"
112+
echo "PR_URL=$PR_URL" >> $GITHUB_OUTPUT
113+
shell: bash

‎examples/security-code-scanner.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: MetaMask Security Code Scanner
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
branches:
9+
- main
10+
workflow_call:
11+
secrets:
12+
SECURITY_SCAN_METRICS_TOKEN:
13+
required: false
14+
APPSEC_BOT_SLACK_WEBHOOK:
15+
required: false
16+
workflow_dispatch:
17+
18+
jobs:
19+
security-scan:
20+
uses: MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@v2
21+
permissions:
22+
actions: read
23+
contents: read
24+
security-events: write
25+
with:
26+
repo: ${{ github.repository }}
27+
scanner-ref: 'v2'
28+
paths-ignored: |
29+
node_modules
30+
**/node_modules/**
31+
**/__snapshots__/
32+
__snapshots_linux__
33+
**/__stories__/
34+
.storybook/
35+
**/*.test.ts
36+
**/*.test.tsx
37+
**/*.test.js
38+
**/*.test.jsx
39+
**/*.spec.ts
40+
**/*.spec.tsx
41+
**/*.spec.js
42+
**/*.spec.jsx
43+
**/test*/**
44+
**/e2e/**
45+
**/tests/**
46+
languages-config: |
47+
[
48+
]
49+
secrets:
50+
project-metrics-token: ${{ secrets.SECURITY_SCAN_METRICS_TOKEN }}
51+
slack-webhook: ${{ secrets.APPSEC_BOT_SLACK_WEBHOOK }}

0 commit comments

Comments
 (0)