From 95c982f98c8d4ae6fcc9ebc29fcd61b31a0d4985 Mon Sep 17 00:00:00 2001 From: ShiftLeft Date: Tue, 31 Jan 2023 08:48:39 -0600 Subject: [PATCH 1/7] adding ShiftLeft build rules --- shiftleft.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 shiftleft.yml diff --git a/shiftleft.yml b/shiftleft.yml new file mode 100644 index 0000000..820144a --- /dev/null +++ b/shiftleft.yml @@ -0,0 +1,15 @@ +version: 2 +build_rules: + - id: Allow no critical findings + severities: + - critical + - id: Allow one OSS or container finding + finding_types: + - oss_vuln + - container + threshold: 1 + - id: Allow no reachable OSS vulnerability + finding_types: + - oss_vuln + options: + reachable: true From 7857233bd046fc1ccea3fb2b3c1aba31e1ab65ff Mon Sep 17 00:00:00 2001 From: ShiftLeft Date: Tue, 31 Jan 2023 08:48:39 -0600 Subject: [PATCH 2/7] adding ShiftLeft GitHub action --- .github/workflows/shiftleft.yml | 45 +++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/shiftleft.yml diff --git a/.github/workflows/shiftleft.yml b/.github/workflows/shiftleft.yml new file mode 100644 index 0000000..78b3987 --- /dev/null +++ b/.github/workflows/shiftleft.yml @@ -0,0 +1,45 @@ +--- +# This workflow integrates ShiftLeft NG SAST with GitHub +# Visit https://docs.shiftleft.io for help +name: ShiftLeft + +on: + pull_request: + workflow_dispatch: + +jobs: + NextGen-Static-Analysis: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Download ShiftLeft CLI + run: | + curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl + - name: Extract branch name + shell: bash + run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})" + id: extract_branch + - name: NextGen Static Analysis + run: ${GITHUB_WORKSPACE}/sl analyze --strict --wait --app shiftleft-c-demo --container 18fgsa/s3-resource --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --c --cpg . + env: + SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} + + Build-Rules: + runs-on: ubuntu-latest + needs: NextGen-Static-Analysis + steps: + - uses: actions/checkout@v3 + - name: Download ShiftLeft CLI + run: | + curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl + - name: Validate Build Rules + run: | + ${GITHUB_WORKSPACE}/sl check-analysis --app shiftleft-c-demo \ + --github-pr-number=${{github.event.number}} \ + --github-pr-user=${{ github.repository_owner }} \ + --github-pr-repo=${{ github.event.repository.name }} \ + --github-token=${{ secrets.GITHUB_TOKEN }} + env: + SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }} + + \ No newline at end of file From 82520dea0bffc9ceae6e28be3d5567f460469fc0 Mon Sep 17 00:00:00 2001 From: janani-cr <123922497+janani-cr@users.noreply.github.com> Date: Mon, 27 Mar 2023 14:43:38 -0500 Subject: [PATCH 3/7] Add .circleci/config.yml --- .circleci/config.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .circleci/config.yml diff --git a/.circleci/config.yml b/.circleci/config.yml new file mode 100644 index 0000000..6554e1f --- /dev/null +++ b/.circleci/config.yml @@ -0,0 +1,26 @@ +# Use the latest 2.1 version of CircleCI pipeline process engine. +# See: https://circleci.com/docs/2.0/configuration-reference +version: 2.1 + +# Define a job to be invoked later in a workflow. +# See: https://circleci.com/docs/2.0/configuration-reference/#jobs +jobs: + say-hello: + # Specify the execution environment. You can specify an image from Dockerhub or use one of our Convenience Images from CircleCI's Developer Hub. + # See: https://circleci.com/docs/2.0/configuration-reference/#docker-machine-macos-windows-executor + docker: + - image: cimg/base:stable + # Add steps to the job + # See: https://circleci.com/docs/2.0/configuration-reference/#steps + steps: + - checkout + - run: + name: "Say hello" + command: "echo Hello, World!" + +# Invoke jobs via workflows +# See: https://circleci.com/docs/2.0/configuration-reference/#workflows +workflows: + say-hello-workflow: + jobs: + - say-hello From b2fbf825ea971dc24b809e32fd83ccfa63bf05b2 Mon Sep 17 00:00:00 2001 From: janani-cr <123922497+janani-cr@users.noreply.github.com> Date: Mon, 27 Mar 2023 16:55:59 -0500 Subject: [PATCH 4/7] Update config.yml --- .circleci/config.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 6554e1f..ff06dff 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -15,8 +15,16 @@ jobs: steps: - checkout - run: - name: "Say hello" - command: "echo Hello, World!" + name: ShiftLeft Build + command: | + mvn clean package #build the app + mkdir -p /tmp/workspace/target #create a directory for Qwiet + mv target/hello-shiftleft-0.0.1.jar /tmp/workspace/target/ + curl https://cdn.shiftleft.io/download/sl > /usr/local/bin/sl && chmod a+rx /usr/local/bin/sl #download Qwiet + PR_USER=$(echo $CIRCLE_PULL_REQUEST | cut -d '/' -f4) + PR_REPO=$(echo $CIRCLE_PULL_REQUEST | cut -d '/' -f5) + PR_NUMBER=$(echo $CIRCLE_PULL_REQUEST | cut -d '/' -f7) + sl analyze --wait --tag branch=$CIRCLE_BRANCH --app shiftleft-c-demo --container 18fgsa/s3-resource --c --cpg . # Invoke jobs via workflows # See: https://circleci.com/docs/2.0/configuration-reference/#workflows From b2a9aac2a8dbc4299d367561cecd64c5d0818b40 Mon Sep 17 00:00:00 2001 From: janani-cr <123922497+janani-cr@users.noreply.github.com> Date: Mon, 27 Mar 2023 16:59:14 -0500 Subject: [PATCH 5/7] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index ff06dff..7bb7e62 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -17,7 +17,7 @@ jobs: - run: name: ShiftLeft Build command: | - mvn clean package #build the app + gcc main.c #build the app mkdir -p /tmp/workspace/target #create a directory for Qwiet mv target/hello-shiftleft-0.0.1.jar /tmp/workspace/target/ curl https://cdn.shiftleft.io/download/sl > /usr/local/bin/sl && chmod a+rx /usr/local/bin/sl #download Qwiet From 25cfbc00d362f30621ea8916eed17e52d31fcd73 Mon Sep 17 00:00:00 2001 From: janani-cr <123922497+janani-cr@users.noreply.github.com> Date: Mon, 27 Mar 2023 17:00:26 -0500 Subject: [PATCH 6/7] Update config.yml --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 7bb7e62..40de7aa 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -17,7 +17,7 @@ jobs: - run: name: ShiftLeft Build command: | - gcc main.c #build the app + #gcc main.c #build the app mkdir -p /tmp/workspace/target #create a directory for Qwiet mv target/hello-shiftleft-0.0.1.jar /tmp/workspace/target/ curl https://cdn.shiftleft.io/download/sl > /usr/local/bin/sl && chmod a+rx /usr/local/bin/sl #download Qwiet From 054097fb49844636698c765f132bcf77c8dafc46 Mon Sep 17 00:00:00 2001 From: janani-cr <123922497+janani-cr@users.noreply.github.com> Date: Mon, 27 Mar 2023 17:01:24 -0500 Subject: [PATCH 7/7] Update config.yml --- .circleci/config.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 40de7aa..1e5c9a5 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -18,8 +18,8 @@ jobs: name: ShiftLeft Build command: | #gcc main.c #build the app - mkdir -p /tmp/workspace/target #create a directory for Qwiet - mv target/hello-shiftleft-0.0.1.jar /tmp/workspace/target/ + #mkdir -p /tmp/workspace/target #create a directory for Qwiet + #mv target/hello-shiftleft-0.0.1.jar /tmp/workspace/target/ curl https://cdn.shiftleft.io/download/sl > /usr/local/bin/sl && chmod a+rx /usr/local/bin/sl #download Qwiet PR_USER=$(echo $CIRCLE_PULL_REQUEST | cut -d '/' -f4) PR_REPO=$(echo $CIRCLE_PULL_REQUEST | cut -d '/' -f5)