Skip to content

Commit e7d024c

Browse files
zhaoqizqwangzhaoqizqwang
authored
Update GIthub workflows for V3 (#5335)
1 parent 8c4585d commit e7d024c

File tree

3 files changed

+192
-0
lines changed

3 files changed

+192
-0
lines changed

‎.github/workflows/ci-health.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: CI Health
2+
on:
3+
schedule:
4+
- cron: "0 */3 * * *"
5+
workflow_dispatch:
6+
7+
permissions:
8+
id-token: write # This is required for requesting the JWT
9+
10+
jobs:
11+
canaries-v3:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Configure AWS Credentials
15+
uses: aws-actions/configure-aws-credentials@v4
16+
with:
17+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
18+
aws-region: us-west-2
19+
role-duration-seconds: 10800
20+
- name: Run Canaries V3
21+
uses: aws-actions/aws-codebuild-run-build@v1
22+
with:
23+
project-name: canaries-v3
24+
canaries-v2:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: Configure AWS Credentials
28+
uses: aws-actions/configure-aws-credentials@v4
29+
with:
30+
role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
31+
aws-region: us-west-2
32+
role-duration-seconds: 10800
33+
- name: Run Canaries V2
34+
uses: aws-actions/aws-codebuild-run-build@v1
35+
with:
36+
project-name: canaries-v2

‎.github/workflows/codeql.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: "CodeQL"
2+
on:
3+
push:
4+
branches: [ "master" ]
5+
pull_request:
6+
branches: [ "master" ]
7+
schedule:
8+
- cron: '30 15 * * *'
9+
jobs:
10+
analyze:
11+
name: Analyze (${{ matrix.language }})
12+
runs-on: ${{ 'ubuntu-latest' }}
13+
permissions:
14+
security-events: write
15+
packages: read
16+
17+
strategy:
18+
matrix:
19+
include:
20+
- language: python
21+
build-mode: none
22+
- language: java-kotlin
23+
build-mode: none
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@6ccd57f4c5d15bdc2fef309bd9fb6cc9db2ef1c6
27+
- name: Initialize CodeQL
28+
uses: github/codeql-action/init@4b1d7da102ff94aca014c0245062b1a463356d72
29+
with:
30+
languages: ${{ matrix.language }}
31+
build-mode: ${{ matrix.build-mode }}
32+
- name: Perform CodeQL Analysis
33+
uses: github/codeql-action/analyze@4b1d7da102ff94aca014c0245062b1a463356d72
34+
with:
35+
category: "/language:${{matrix.language}}"

‎.github/workflows/security-monitoring.yml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: Security Monitoring
2+
3+
on:
4+
schedule:
5+
- cron: '0 16 * * *'
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.run_id }}
9+
cancel-in-progress: true
10+
11+
permissions:
12+
id-token: write
13+
14+
jobs:
15+
check-code-scanning-alerts:
16+
runs-on: ubuntu-latest
17+
outputs:
18+
code_scanning_alert_status: ${{ steps.check-code-scanning-alerts.outputs.code_scanning_alert_status }}
19+
steps:
20+
- name: Check for security alerts
21+
id: check-code-scanning-alerts
22+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
23+
with:
24+
github-token: ${{ secrets.GH_PAT }}
25+
script: |
26+
async function checkAlerts() {
27+
const owner = '${{ github.repository_owner }}';
28+
const repo = '${{ github.event.repository.name }}';
29+
const ref = 'refs/heads/master';
30+
31+
const codeScanningAlerts = await github.rest.codeScanning.listAlertsForRepo({
32+
owner,
33+
repo,
34+
ref: ref
35+
});
36+
const activeCodeScanningAlerts = codeScanningAlerts.data.filter(alert => alert.state === 'open');
37+
core.setOutput('code_scanning_alert_status', activeCodeScanningAlerts.length > 0 ? '1': '0');
38+
}
39+
await checkAlerts();
40+
41+
check-dependabot-alerts:
42+
runs-on: ubuntu-latest
43+
outputs:
44+
dependabot_alert_status: ${{ steps.check-dependabot-alerts.outputs.dependabot_alert_status }}
45+
steps:
46+
- name: Check for dependabot alerts
47+
id: check-dependabot-alerts
48+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
49+
with:
50+
github-token: ${{ secrets.GH_PAT }}
51+
script: |
52+
async function checkAlerts() {
53+
const owner = '${{ github.repository_owner }}';
54+
const repo = '${{ github.event.repository.name }}';
55+
56+
const dependabotAlerts = await github.rest.dependabot.listAlertsForRepo({
57+
owner,
58+
repo,
59+
headers: {
60+
'accept': 'applications/vnd.github+json'
61+
}
62+
});
63+
const activeDependabotAlerts = dependabotAlerts.data.filter(alert => alert.state === 'open');
64+
core.setOutput('dependabot_alert_status', activeDependabotAlerts.length > 0 ? '1': '0');
65+
}
66+
await checkAlerts();
67+
68+
check-secret-scanning-alerts:
69+
runs-on: ubuntu-latest
70+
outputs:
71+
secret_scanning_alert_status: ${{ steps.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }}
72+
steps:
73+
- name: Check for secret scanning alerts
74+
id: check-secret-scanning-alerts
75+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
76+
with:
77+
github-token: ${{ secrets.GH_PAT }}
78+
script: |
79+
async function checkAlerts() {
80+
const owner = '${{ github.repository_owner }}';
81+
const repo = '${{ github.event.repository.name }}';
82+
83+
const secretScanningAlerts = await github.rest.secretScanning.listAlertsForRepo({
84+
owner,
85+
repo,
86+
});
87+
const activeSecretScanningAlerts = secretScanningAlerts.data.filter(alert => alert.state === 'open');
88+
core.setOutput('secret_scanning_alert_status', activeSecretScanningAlerts.length > 0 ? '1': '0');
89+
}
90+
await checkAlerts();
91+
92+
put-metric-data:
93+
runs-on: ubuntu-latest
94+
needs: [check-code-scanning-alerts, check-dependabot-alerts, check-secret-scanning-alerts]
95+
steps:
96+
- name: Configure AWS Credentials
97+
uses: aws-actions/configure-aws-credentials@12e3392609eaaceb7ae6191b3f54bbcb85b5002b
98+
with:
99+
role-to-assume: ${{ secrets.MONITORING_ROLE_ARN }}
100+
aws-region: us-west-2
101+
- name: Put Code Scanning Alert Metric Data
102+
run: |
103+
if [ "${{ needs.check-code-scanning-alerts.outputs.code_scanning_alert_status }}" == "1" ]; then
104+
aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk
105+
else
106+
aws cloudwatch put-metric-data --metric-name CodeScanningAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk
107+
fi
108+
- name: Put Dependabot Alert Metric Data
109+
run: |
110+
if [ "${{ needs.check-dependabot-alerts.outputs.dependabot_alert_status }}" == "1" ]; then
111+
aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk
112+
else
113+
aws cloudwatch put-metric-data --metric-name DependabotAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk
114+
fi
115+
- name: Put Secret Scanning Alert Metric Data
116+
run: |
117+
if [ "${{ needs.check-secret-scanning-alerts.outputs.secret_scanning_alert_status }}" == "1" ]; then
118+
aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecurityMonitoringMetrics --value 1 --unit Count --dimensions ProjectName=sagemaker-python-sdk
119+
else
120+
aws cloudwatch put-metric-data --metric-name SecretScanningAlert --namespace SecurityMonitoringMetrics --value 0 --unit Count --dimensions ProjectName=sagemaker-python-sdk
121+
fi

0 commit comments

Comments
 (0)