dev-registry/.github/workflows/scan-test.yml at 15c77b99d83a959717a7f98dc95a47d98fc219da · boostsecurityio/dev-registry · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
# NOTE: Updates to this workflow should be done on the scanner-registry repository
# (not a fork) to validate the test harness is healthy. PRs from forks use the
# workflow from main via pull_request_target, while same-repo PRs use the workflow
# from the PR branch via pull_request.

name: Scan Tests

on:
  pull_request:
    types: [opened, synchronize, reopened]
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  id-token: write  # Required for OIDC

jobs:
  azure-devops-pipelines:
    name: Azure DevOps Pipelines
    runs-on: ubuntu-latest
    # Require a reviewer to allow the workflow to run when coming from a fork
    environment: ${{ github.event_name == 'pull_request_target' && 'scan-test' || '' }}
    # Run on pull_request for same-repo PRs, pull_request_target for fork PRs
    if: |
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
    steps:
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.BOOST_SCAN_RUNNER_ADO_CLIENT_ID }}
          tenant-id: ${{ secrets.BOOST_SCAN_RUNNER_ADO_TENANT_ID }}
          allow-no-subscriptions: true
      - name: Get Azure DevOps Token
        id: azure-token
        run: |
          token=$(az account get-access-token \
            --resource 499b84ac-1321-427f-aa17-267ca6975798 \
            --query accessToken -o tsv)
          echo "token=$token" >> $GITHUB_OUTPUT
          echo "::add-mask::$token"
      - name: Checkout scanner registry
        uses: actions/checkout@v4
        with:
          # Checkout the pull request's code to read the new tests.yaml
          fetch-depth: 0  # Need full history to detect changes
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Run Tests
        uses: boostsecurityio/scan-test-action@05297ee358226347a9f4989716ffeb7ba1dedc4f
        with:
          provider: azure-devops
          provider-config: |
            {
              "token": "${{ steps.azure-token.outputs.token }}",
              "organization": "BoostSecurity",
              "project": "cicd-tools",
              "pipeline_id": 1
            }
          # Target the pull request's code to read the new module.yaml
          # WARNING: This runs arbitrary code in pre-scan checks, it MUST be blocked by an environment to manually allow workflow to run.
          registry-repo: ${{ github.event.pull_request.head.repo.full_name }}
          registry-ref: ${{ github.event.pull_request.head.sha }}
          base-ref: ${{ github.event.pull_request.base.sha }}
          fallback-scanners: "boostsecurityio/trivy-fs,boostsecurityio/trivy-image"
          allowed-env-prefixes: "CODEQL_,BOOST_"
  bitbucket-action:
    name: Bitbucket Pipelines
    runs-on: ubuntu-latest
    # Require a reviewer to allow the workflow to run when coming from a fork
    environment: ${{ github.event_name == 'pull_request_target' && 'scan-test' || '' }}
    # Run on pull_request for same-repo PRs, pull_request_target for fork PRs
    if: |
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
    steps:
      - name: Generate Bitbucket OAuth Token
        id: bitbucket-token
        run: |
          response=$(curl -s -X POST \
            "https://bitbucket.org/site/oauth2/access_token" \
            -u "${{ secrets.BOOST_SCAN_RUNNER_BITBUCKET_CLIENT_ID }}:${{ secrets.BOOST_SCAN_RUNNER_BITBUCKET_CLIENT_SECRET }}" \
            -d "grant_type=client_credentials")

          token=$(echo "$response" | jq -r '.access_token')
          echo "token=$token" >> $GITHUB_OUTPUT
          echo "::add-mask::$token"
      - name: Checkout scanner registry
        uses: actions/checkout@v4
        with:
          # Checkout the pull request's code to read the new tests.yaml
          fetch-depth: 0  # Need full history to detect changes
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Run Tests
        uses: boostsecurityio/scan-test-action@05297ee358226347a9f4989716ffeb7ba1dedc4f
        with:
          provider: bitbucket
          provider-config: |
            {
              "token": "${{ steps.bitbucket-token.outputs.token }}",
              "workspace": "boostsecurityio",
              "repo_slug": "scan-test-runner-bitbucket-pipelines"
            }
          # Target the pull request's code to read the new module.yaml
          # WARNING: This runs arbitrary code in pre-scan checks, it MUST be blocked by an environment to manually allow workflow to run.
          registry-repo: ${{ github.event.pull_request.head.repo.full_name }}
          registry-ref: ${{ github.event.pull_request.head.sha }}
          base-ref: ${{ github.event.pull_request.base.sha }}
          fallback-scanners: "boostsecurityio/trivy-fs,boostsecurityio/trivy-image"
          allowed-env-prefixes: "CODEQL_,BOOST_"

  github-action:
    name: Github Actions
    runs-on: ubuntu-latest
    # Require a reviewer to allow the workflow to run when coming from a fork
    environment: ${{ github.event_name == 'pull_request_target' && 'scan-test' || '' }}
    # Run on pull_request for same-repo PRs, pull_request_target for fork PRs
    if: |
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
    steps:
      - name: Generate GitHub App Token
        id: github-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.BOOST_SCAN_RUNNER_GITHUB_APP_ID }}
          private-key: ${{ secrets.BOOST_SCAN_RUNNER_GITHUB_APP_PRIVATE_KEY }}
          owner: boostsecurityio
          repositories: scan-test-runner-gitbub-actions
      - name: Checkout scanner registry
        uses: actions/checkout@v4
        with:
          # Checkout the pull request's code to read the new tests.yaml
          fetch-depth: 0  # Need full history to detect changes
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Run Tests
        uses: boostsecurityio/scan-test-action@05297ee358226347a9f4989716ffeb7ba1dedc4f
        with:
          provider: github-actions
          provider-config: |
            {
              "token": "${{ steps.github-token.outputs.token }}",
              "owner": "boostsecurityio",
              "repo": "scan-test-runner-gitbub-actions",
              "workflow_id": "test-scanner.yml"
            }
          # Target the pull request's code to read the new module.yaml
          # WARNING: This runs arbitrary code in pre-scan checks, it MUST be blocked by an environment to manually allow workflow to run.
          registry-repo: ${{ github.event.pull_request.head.repo.full_name }}
          registry-ref: ${{ github.event.pull_request.head.sha }}
          base-ref: ${{ github.event.pull_request.base.sha }}
          fallback-scanners: "boostsecurityio/trivy-fs,boostsecurityio/trivy-image"
          allowed-env-prefixes: "CODEQL_,BOOST_"

  gitlab-ci:
    name: Gitlab-CI
    runs-on: ubuntu-latest
    # Require a reviewer to allow the workflow to run when coming from a fork
    environment: ${{ github.event_name == 'pull_request_target' && 'scan-test' || '' }}
    # Run on pull_request for same-repo PRs, pull_request_target for fork PRs
    if: |
      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository)
    steps:
      - name: Checkout scanner registry
        uses: actions/checkout@v4
        with:
          # Checkout the pull request's code to read the new tests.yaml
          fetch-depth: 0  # Need full history to detect changes
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Run Tests
        uses: boostsecurityio/scan-test-action@05297ee358226347a9f4989716ffeb7ba1dedc4f
        with:
          provider: gitlab-ci
          provider-config: |
            {
              "trigger_token": "${{ secrets.BOOST_SCAN_RUNNER_GITLAB_TRIGGER_TOKEN }}",
              "api_token": "${{ secrets.BOOST_SCAN_RUNNER_GITLAB_READ_TOKEN }}",
              "project_id": "boostsecurityio/scan-test-runner-gitlab-ci"
            }
          # Target the pull request's code to read the new module.yaml
          # WARNING: This runs arbitrary code in pre-scan checks, it MUST be blocked by an environment to manually allow workflow to run.
          registry-repo: ${{ github.event.pull_request.head.repo.full_name }}
          registry-ref: ${{ github.event.pull_request.head.sha }}
          base-ref: ${{ github.event.pull_request.base.sha }}
          fallback-scanners: "boostsecurityio/trivy-fs,boostsecurityio/trivy-image"
          allowed-env-prefixes: "CODEQL_,BOOST_"