Skip to content

Commit 9679b70

Browse files
thpiercethpierce
authored
Replace OWASP workflow (#882)
Align with Python: * https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/.github/actions/image_scan/action.yml * https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/.github/workflows/daily_scan.yml By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
1 parent 0e78953 commit 9679b70

File tree

3 files changed

+131
-46
lines changed

3 files changed

+131
-46
lines changed

‎.github/actions/image_scan/action.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
## Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: Apache-2.0
3+
name: image-scan
4+
description: |
5+
This action performs a scan of a provided (local or public ECR remote) image, using Trivy.
6+
7+
inputs:
8+
image-ref:
9+
required: true
10+
description: "Reference for the image to be scanned"
11+
severity:
12+
required: true
13+
description: "List of severities that will cause a failure"
14+
15+
runs:
16+
using: "composite"
17+
steps:
18+
19+
# Per https://docs.aws.amazon.com/AmazonECR/latest/public/docker-pull-ecr-image.html, it is possible to
20+
# make unauthorized calls to get public ECR images (needed to build the ADOT Java docker image), but
21+
# it can fail if you previously authenticated to a public repo. Adding this step to log out, so we
22+
# ensure we can make unauthenticated call. This is important for making the pr_build workflow run on
23+
# PRs created from forked repos.
24+
- name: Logout of public AWS ECR
25+
shell: bash
26+
run: docker logout public.ecr.aws
27+
28+
- name: Run Trivy vulnerability scanner on image
29+
uses: aquasecurity/trivy-action@master
30+
with:
31+
image-ref: ${{ inputs.image-ref }}
32+
severity: ${{ inputs.severity }}
33+
exit-code: '1'

‎.github/workflows/owasp.yml

Lines changed: 90 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,70 +1,114 @@
1+
## Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: Apache-2.0
3+
# Performs a daily scan of:
4+
# * The latest released ADOT Java image, using Trivy
5+
# * Project dependencies, using DependencyCheck
6+
#
7+
# Publishes results to CloudWatch Metrics.
8+
name: Daily scan
19

2-
name: Daily scan for dependencies
310
on:
411
schedule:
5-
- cron: "22 3 * * *"
6-
workflow_dispatch:
12+
- cron: '0 18 * * *' # scheduled to run at 18:00 UTC every day
13+
workflow_dispatch: # be able to run the workflow on demand
14+
15+
env:
16+
AWS_DEFAULT_REGION: us-east-1
717

818
permissions:
919
id-token: write
1020
contents: read
1121

1222
jobs:
13-
check-dependencies-adot-java:
23+
scan_and_report:
1424
runs-on: ubuntu-latest
1525
steps:
16-
- uses: actions/checkout@v4
26+
- name: Checkout repo for dependency scan
27+
uses: actions/checkout@v4
1728
with:
1829
fetch-depth: 0
19-
- uses: actions/setup-java@v4
30+
31+
- name: Set up Java for dependency scan
32+
uses: actions/setup-java@v4
2033
with:
2134
java-version: 17
2235
distribution: 'temurin'
23-
- name: Build snapshot with Gradle
24-
uses: gradle/gradle-build-action@v3
36+
37+
- name: Configure AWS credentials for dependency scan
38+
uses: aws-actions/configure-aws-credentials@v4
2539
with:
26-
arguments: ":otelagent:dependencyCheckAnalyze"
27-
- name: Upload report
28-
if: ${{ always() }}
29-
uses: actions/upload-artifact@v3
40+
role-to-assume: ${{ secrets.SECRET_MANAGER_ROLE_ARN }}
41+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
42+
43+
- name: Get NVD API key for dependency scan
44+
uses: aws-actions/aws-secretsmanager-get-secrets@v1
45+
id: nvd_api_key
3046
with:
31-
name: adot-dependencies
32-
path: otelagent/build/reports
47+
secret-ids: ${{ secrets.NVD_API_KEY_SECRET_ARN }}
48+
parse-json-secrets: true
3349

34-
check-dependencies-otel-java:
35-
runs-on: ubuntu-latest
36-
steps:
37-
- uses: actions/checkout@v4
50+
- name: Publish patched dependencies to maven local
51+
uses: ./.github/actions/patch-dependencies
52+
53+
- name: Build JAR
54+
uses: gradle/gradle-build-action@v3
3855
with:
39-
repository: "open-telemetry/opentelemetry-java-instrumentation"
40-
fetch-depth: 0
41-
- uses: actions/setup-java@v4
56+
arguments: assemble -PlocalDocker=true
57+
58+
# See http://jeremylong.github.io/DependencyCheck/dependency-check-cli/ for installation explanation
59+
- name: Install and run dependency scan
60+
id: dep_scan
61+
if: always()
62+
run: |
63+
gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 259A55407DD6C00299E6607EFFDE55BE73A2D1ED
64+
VERSION=$(curl -s https://jeremylong.github.io/DependencyCheck/current.txt)
65+
curl -Ls "https://github.com/jeremylong/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip" --output dependency-check.zip
66+
curl -Ls "https://github.com/jeremylong/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip.asc" --output dependency-check.zip.asc
67+
gpg --verify dependency-check.zip.asc
68+
unzip dependency-check.zip
69+
./dependency-check/bin/dependency-check.sh --failOnCVSS 0 --nvdApiKey ${{ env.NVD_API_KEY_NVD_API_KEY }} -s 'otelagent/build/libs/aws-opentelemetry-agent-*-SNAPSHOT.jar'
70+
71+
- name: Print dependency scan results on failure
72+
if: ${{ steps.dep_scan.outcome != 'success' }}
73+
run: less dependency-check-report.html
74+
75+
- name: Perform high image scan
76+
if: always()
77+
id: high_scan
78+
uses: ./.github/actions/image_scan
4279
with:
43-
java-version: 17
44-
distribution: 'temurin'
45-
- name: Build snapshot with Gradle
46-
uses: gradle/gradle-build-action@v3
80+
image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v1.32.3"
81+
severity: 'CRITICAL,HIGH'
82+
83+
- name: Perform low image scan
84+
if: always()
85+
id: low_scan
86+
uses: ./.github/actions/image_scan
4787
with:
48-
arguments: ":javaagent:dependencyCheckAnalyze"
49-
- name: Upload report
50-
if: ${{ always() }}
51-
uses: actions/upload-artifact@v3
88+
image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-java:v1.32.3"
89+
severity: 'MEDIUM,LOW,UNKNOWN'
90+
91+
- name: Configure AWS Credentials for emitting metrics
92+
if: always()
93+
uses: aws-actions/configure-aws-credentials@v4
5294
with:
53-
name: otel-dependencies
54-
path: javaagent/build/reports
55-
56-
publish-status:
57-
needs: ["check-dependencies-adot-java", "check-dependencies-otel-java"]
58-
if: ${{ always() }}
59-
uses: ./.github/workflows/publish-status.yml
60-
with:
61-
namespace: 'ADOT/GitHubActions'
62-
repository: ${{ github.repository }}
63-
branch: ${{ github.ref_name }}
64-
workflow: owasp
65-
success: ${{ needs.check-dependencies-adot-java.result == 'success' &&
66-
needs.check-dependencies-otel-java.result == 'success'}}
67-
region: us-east-1
68-
secrets:
69-
roleArn: ${{ secrets.METRICS_ROLE_ARN }}
95+
role-to-assume: ${{ secrets.METRICS_ROLE_ARN }}
96+
aws-region: ${{ env.AWS_DEFAULT_REGION }}
97+
98+
- name: Publish high scan status
99+
if: always()
100+
run: |
101+
value="${{ steps.high_scan.outcome == 'success' && '1.0' || '0.0' }}"
102+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
103+
--metric-name Success \
104+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=daily_scan_high \
105+
--value $value
70106
107+
- name: Publish low scan status
108+
if: always()
109+
run: |
110+
value="${{ steps.low_scan.outcome == 'success' && steps.dep_scan.outcome == 'success' && '1.0' || '0.0'}}"
111+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
112+
--metric-name Success \
113+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=daily_scan_low \
114+
--value $value

‎.github/workflows/pr-build.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,13 @@ jobs:
116116
tags: ${{ env.TEST_TAG }}
117117
load: true
118118

119+
- name: Perform image scan
120+
uses: ./.github/actions/image_scan
121+
if: ${{ matrix.os == 'ubuntu-latest' }}
122+
with:
123+
image-ref: ${{ env.TEST_TAG }}
124+
severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
125+
119126
- name: Test docker image
120127
if: ${{ matrix.os == 'ubuntu-latest' }}
121128
shell: bash
@@ -127,3 +134,4 @@ jobs:
127134
with:
128135
arguments: build --stacktrace -PenableCoverage=true
129136
- uses: codecov/codecov-action@v3
137+

0 commit comments

Comments
 (0)