Skip to content

Commit 132087a

Browse files
damienjburksdamienjburks
authored
Initial commit
0 parents  commit 132087a

File tree

17 files changed

+824
-0
lines changed

17 files changed

+824
-0
lines changed

‎.github/.DS_Store‎

6 KB
Binary file not shown.

‎.github/dependabot.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Set update schedule for GitHub Actions
2+
version: 2
3+
updates:
4+
5+
- package-ecosystem: "github-actions"
6+
directory: "/"
7+
schedule:
8+
# Check for updates to GitHub Actions every week
9+
interval: "daily"

‎.github/workflows/build-image.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Build Docker Image
2+
on:
3+
workflow_call:
4+
5+
6+
jobs:
7+
# Build Docker Image
8+
build:
9+
name: Build Docker Image
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout code
14+
uses: actions/checkout@v4
15+
16+
- name: Build Docker Image
17+
run: |
18+
docker build -t python-fastapi:${{ github.sha }} .
19+

‎.github/workflows/lint-format.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Linting and Formatting Checks
2+
on:
3+
workflow_call:
4+
5+
jobs:
6+
# Run Pylint
7+
pylint:
8+
name: Run pylint checks
9+
runs-on: ubuntu-latest
10+
strategy:
11+
matrix:
12+
python-version: ["3.12.6"]
13+
14+
steps:
15+
- uses: actions/checkout@v4
16+
- name: "Setup Python ${{ matrix.python-version}}"
17+
uses: actions/setup-python@v5
18+
with:
19+
python-version: "${{ matrix.python-version}}"
20+
21+
- name: Install dependencies
22+
run: |
23+
pip install -r requirements.txt
24+
python -m pip install --upgrade pip
25+
26+
- name: Run pylint
27+
run: pylint .
28+
29+
# Run Black
30+
black:
31+
name: Run black formatting checks
32+
runs-on: ubuntu-latest
33+
needs: pylint
34+
strategy:
35+
matrix:
36+
python-version: ["3.12.6"]
37+
38+
steps:
39+
- uses: actions/checkout@v4
40+
- name: "Setup Python ${{ matrix.python-version}}"
41+
uses: actions/setup-python@v5
42+
with:
43+
python-version: "${{ matrix.python-version}}"
44+
45+
- name: Install dependencies
46+
run: |
47+
pip install -r requirements.txt
48+
python -m pip install --upgrade pip
49+
50+
- name: Run black
51+
run: black --check .

‎.github/workflows/main.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Main Workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
security-events: write
11+
actions: read
12+
id-token: write
13+
packages: write
14+
15+
jobs:
16+
build-image:
17+
uses: ./.github/workflows/build-image.yml
18+
19+
lint-format:
20+
uses: ./.github/workflows/lint-format.yml
21+
needs: build-image
22+
23+
unit-sec-scan:
24+
uses: ./.github/workflows/unit-sec-test.yml
25+
needs: lint-format
26+
27+
push-docker-image:
28+
uses: ./.github/workflows/push-docker-image.yml
29+
needs: unit-sec-scan

‎.github/workflows/pr.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: PR Workflow
2+
on:
3+
pull_request:
4+
types:
5+
- opened
6+
- edited
7+
- synchronize
8+
- reopened
9+
10+
permissions:
11+
contents: read
12+
security-events: write
13+
actions: read
14+
15+
jobs:
16+
build-image:
17+
uses: ./.github/workflows/build-image.yml
18+
19+
lint-format:
20+
uses: ./.github/workflows/lint-format.yml
21+
needs: build-image
22+
23+
unit-sec-scan:
24+
uses: ./.github/workflows/unit-sec-test.yml
25+
needs: lint-format

‎.github/workflows/push-docker-image.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Push Docker Image
2+
3+
4+
on:
5+
workflow_call:
6+
7+
env:
8+
# Use docker.io for Docker Hub if empty
9+
REGISTRY: ghcr.io
10+
IMAGE_NAME: 'python-fastapi'
11+
12+
13+
jobs:
14+
Push_Image:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
20+
# Set up Docker Buildx
21+
- name: Set up Docker Buildx
22+
id: buildx
23+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
24+
25+
# Extract metadata (tags, labels) for Docker
26+
- name: Extract metadata for Docker
27+
id: meta
28+
uses: docker/metadata-action@v5
29+
with:
30+
images: ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
31+
32+
# Login against a Docker registry
33+
- name: Log into registry ${{ env.REGISTRY }}
34+
if: github.event_name != 'pull_request'
35+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
42+
# Build and tag Docker Image
43+
- name: Build Docker Image
44+
run: |
45+
docker build -t ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
46+
47+
- name: Tag Docker Image
48+
run: |
49+
docker tag ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
50+
docker tag ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:testing
51+
52+
53+
# Push the Docker image to the registry
54+
- name: Push Docker Image to GHCR
55+
run: |
56+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
57+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
58+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:testing

‎.github/workflows/push-image.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Push Contianer to Docker Hub
2+
on:
3+
workflow_call:
4+
5+
6+
jobs:
7+
8+
docker:
9+
runs-on: ubuntu-latest
10+
steps:
11+
-
12+
name: login to Docker Hub
13+
uses: docker/login-action@v3
14+
with:
15+
username: ${{ secrets.DOCKERHUB_USERNAME }}
16+
password: ${{ secrets.DOCKERHUB_TOKEN }}
17+
-
18+
name: Set up QEMU
19+
uses: docker/setup-buildx-action@v3
20+
-
21+
name: Set up Docker Buildx
22+
uses: docker/setup-buildx-action@v3
23+
-
24+
name: Build and Push
25+
uses: docker/build-push-action@v6
26+
with:
27+
push: true
28+
tags: user/app:latest
29+

‎.github/workflows/unit-sec-test.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Unit and Security Scanning
2+
on:
3+
workflow_call:
4+
5+
jobs:
6+
# Run unit test cases for the Docker image
7+
unit_test:
8+
name: Run unit test
9+
runs-on: ubuntu-latest
10+
needs: ['trivy_scans', 'owasp_zap_scan'] # Ensure this job runs after the security scans
11+
12+
steps:
13+
- name: Checkout repository
14+
uses: actions/checkout@v4
15+
16+
- name: Install dependencies
17+
run: |
18+
pip install -r requirements.txt
19+
20+
- name: Run tests
21+
run: pytest tests/
22+
23+
# Scan the contianer and lists all security vulnerabilities
24+
trivy_scans:
25+
name: Run Trivy security scanner against the image
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout code
29+
uses: actions/checkout@v4
30+
31+
- name: Build Docker Image
32+
run: |
33+
docker build -t python-fastapi:${{ github.sha }} . ###- This section needed to be added becasue the image was not persisting between jobs--##
34+
35+
- name: Run Trivy Vulnerability Scanner
36+
uses: aquasecurity/[email protected]
37+
with:
38+
image-ref: 'python-fastapi:${{ github.sha }}'
39+
format: 'sarif'
40+
output: 'trivy-results.sarif'
41+
severity: 'CRITICAL,HIGH'
42+
43+
- name: Upload Trivy scan results to GitHub Security tab
44+
uses: github/codeql-action/upload-sarif@v3
45+
with:
46+
sarif_file: 'trivy-results.sarif'
47+
48+
owasp_zap_scan:
49+
runs-on: ubuntu-latest
50+
name: app scan
51+
steps:
52+
- name: Checkout
53+
uses: actions/checkout@v4
54+
55+
# Build and Tag Image
56+
# Run Docker Image in detached mode
57+
- name: Build Docker Image
58+
run: |
59+
docker build -t python-fastapi:${{ github.sha }} .
60+
docker run -d -p 8080:8080 python-fastapi:${{ github.sha }}
61+
62+
- name: Wait for Docker container to be ready
63+
run: sleep 30
64+
65+
- name: Confirm Docker container is running
66+
run: docker ps
67+
68+
# Run OWASP ZAP scan
69+
- name: zap scan
70+
uses: zaproxy/[email protected]
71+
with:
72+
token: ${{ secrets.GITHUB_TOKEN }}
73+
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
74+
format: openapi
75+
target: 'http://0.0.0.0:8080'
76+
rules_file_name: '.zap/rules.tsv'
77+
cmd_options: '-a'
78+
allow_issue_writing: false

0 commit comments

Comments
 (0)