Skip to content

Commit 1dc97ef

Browse files
sebastienfontainesebastienfontaine
committed
wip
1 parent c049cce commit 1dc97ef

File tree

3 files changed

+110
-83
lines changed

3 files changed

+110
-83
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 85 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -38,60 +38,64 @@ jobs:
3838
if: always()
3939
uses: davelosert/vitest-coverage-report-action@v2
4040

41-
semgrep_scan:
42-
name: semgrep/ci
43-
runs-on: ubuntu-latest
44-
container:
45-
image: returntocorp/semgrep
46-
# Skip any PR created by dependabot to avoid permission issues:
47-
if: (github.actor != 'dependabot[bot]')
48-
permissions:
49-
security-events: write
50-
actions: read
51-
contents: read
52-
steps:
53-
- name: Checkout repository
54-
uses: actions/checkout@v4
55-
56-
- name: Perform Semgrep Analysis (fails on findings)
57-
run: semgrep scan -q --error --config auto --sarif -o semgrep-results.sarif .
58-
59-
- name: Save SARIF results as artifact
60-
uses: actions/upload-artifact@v4
61-
with:
62-
name: semgrep-scan-results
63-
path: semgrep-results.sarif
64-
65-
- name: Upload SARIF result to the GitHub Security Dashboard
66-
if: always() && hashFiles('semgrep-results.sarif') != ''
67-
uses: github/codeql-action/upload-sarif@v3
68-
with:
69-
sarif_file: semgrep-results.sarif
41+
# semgrep_scan:
42+
# name: semgrep/ci
43+
# runs-on: ubuntu-latest
44+
# container:
45+
# image: returntocorp/semgrep
46+
# # Skip any PR created by dependabot to avoid permission issues:
47+
# if: (github.actor != 'dependabot[bot]')
48+
# permissions:
49+
# security-events: write
50+
# actions: read
51+
# contents: read
52+
# steps:
53+
# - name: Checkout repository
54+
# uses: actions/checkout@v4
55+
#
56+
# - name: Perform Semgrep Analysis (fails on findings)
57+
# run: semgrep scan -q --error --config auto --sarif -o semgrep-results.sarif .
58+
#
59+
# - name: Save SARIF results as artifact
60+
# uses: actions/upload-artifact@v4
61+
# with:
62+
# name: semgrep-scan-results
63+
# path: semgrep-results.sarif
64+
#
65+
# - name: Upload SARIF result to the GitHub Security Dashboard
66+
# if: always() && hashFiles('semgrep-results.sarif') != ''
67+
# uses: github/codeql-action/upload-sarif@v3
68+
# with:
69+
# sarif_file: semgrep-results.sarif
7070

7171
gitleaks_scan:
7272
name: Gitleaks Secret Scan
7373
runs-on: ubuntu-latest
7474
steps:
7575
- name: Checkout repository
7676
uses: actions/checkout@v4
77-
78-
- name: Run Gitleaks (fail on leaks)
79-
uses: docker://gitleaks/gitleaks:latest
8077
with:
81-
args: detect --source . --no-git --redact --report-format sarif --report-path gitleaks.sarif --exit-code 1
78+
fetch-depth: 0 # Fetch all history for all branches and tags
79+
80+
- name: Run Gitleaks
81+
uses: gitleaks/gitleaks-action@v2
82+
env:
83+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
84+
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # Only needed for Gitleaks Enterprise
8285

8386
- name: Upload Gitleaks SARIF as artifact
84-
if: always() && hashFiles('gitleaks.sarif') != ''
87+
if: always() && hashFiles('results.sarif') != ''
8588
uses: actions/upload-artifact@v4
8689
with:
8790
name: gitleaks-scan-results
88-
path: gitleaks.sarif
91+
path: results.sarif
8992

9093
- name: Upload Gitleaks SARIF to Code Scanning
91-
if: always() && hashFiles('gitleaks.sarif') != ''
94+
if: always() && hashFiles('results.sarif') != ''
9295
uses: github/codeql-action/upload-sarif@v3
9396
with:
94-
sarif_file: gitleaks.sarif
97+
sarif_file: results.sarif
98+
category: gitleaks
9599

96100
dependency_audit:
97101
name: Dependency Vulnerability Audit
@@ -114,50 +118,50 @@ jobs:
114118
- name: Audit dependencies (high severity and above)
115119
run: npx --yes audit-ci --package-manager yarn --severity high
116120

117-
codeql_sast:
118-
name: CodeQL SAST
119-
runs-on: ubuntu-latest
120-
steps:
121-
- name: Checkout repository
122-
uses: actions/checkout@v4
123-
124-
- name: Initialize CodeQL
125-
uses: github/codeql-action/init@v3
126-
with:
127-
languages: javascript-typescript
128-
queries: security-extended,security-and-quality
129-
130-
- name: Autobuild
131-
uses: github/codeql-action/autobuild@v3
132-
133-
- name: Perform CodeQL Analysis (generate SARIF)
134-
uses: github/codeql-action/analyze@v3
135-
with:
136-
output: codeql-results
137-
upload: true
138-
wait-for-processing: true
139-
140-
- name: Upload CodeQL SARIF as artifact
141-
if: always()
142-
uses: actions/upload-artifact@v4
143-
with:
144-
name: codeql-scan-results
145-
path: codeql-results/*.sarif
146-
147-
- name: Fail if CodeQL alerts found
148-
run: |
149-
set -euo pipefail
150-
files=(codeql-results/*.sarif)
151-
if [ ${#files[@]} -eq 0 ]; then
152-
echo "No SARIF files found in codeql-results; skipping fail check."
153-
exit 0
154-
fi
155-
total=$(jq '[.runs[].results | length] | add // 0' ${files[@]})
156-
echo "CodeQL alerts: $total"
157-
if [ "$total" -gt 0 ]; then
158-
echo "Failing due to CodeQL alerts."
159-
exit 1
160-
fi
121+
# codeql_sast:
122+
# name: CodeQL SAST
123+
# runs-on: ubuntu-latest
124+
# steps:
125+
# - name: Checkout repository
126+
# uses: actions/checkout@v4
127+
#
128+
# - name: Initialize CodeQL
129+
# uses: github/codeql-action/init@v3
130+
# with:
131+
# languages: javascript-typescript
132+
# queries: security-extended,security-and-quality
133+
#
134+
# - name: Autobuild
135+
# uses: github/codeql-action/autobuild@v3
136+
#
137+
# - name: Perform CodeQL Analysis (generate SARIF)
138+
# uses: github/codeql-action/analyze@v3
139+
# with:
140+
# output: codeql-results
141+
# upload: true
142+
# wait-for-processing: true
143+
#
144+
# - name: Upload CodeQL SARIF as artifact
145+
# if: always()
146+
# uses: actions/upload-artifact@v4
147+
# with:
148+
# name: codeql-scan-results
149+
# path: codeql-results/*.sarif
150+
#
151+
# - name: Fail if CodeQL alerts found
152+
# run: |
153+
# set -euo pipefail
154+
# files=(codeql-results/*.sarif)
155+
# if [ ${#files[@]} -eq 0 ]; then
156+
# echo "No SARIF files found in codeql-results; skipping fail check."
157+
# exit 0
158+
# fi
159+
# total=$(jq '[.runs[].results | length] | add // 0' ${files[@]})
160+
# echo "CodeQL alerts: $total"
161+
# if [ "$total" -gt 0 ]; then
162+
# echo "Failing due to CodeQL alerts."
163+
# exit 1
164+
# fi
161165

162166
clamav_malware_scan:
163167
name: ClamAV Malware Scan

‎docs/SECURITY-TESTING.md‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,10 +78,30 @@ semgrep scan --config auto .
7878
brew install gitleaks # macOS
7979
# or download from https://github.com/gitleaks/gitleaks/releases
8080

81-
# Run scan
82-
gitleaks detect --source . --no-git
81+
# Run scan (detects secrets in current state)
82+
gitleaks detect --source . --verbose
83+
84+
# Scan full git history (like CI does)
85+
gitleaks detect --source . --verbose --log-opts="--all"
86+
87+
# Generate SARIF report (like CI)
88+
gitleaks detect --source . --report-path results.sarif --report-format sarif
89+
90+
# Baseline: Create a baseline to ignore existing issues
91+
gitleaks detect --source . --baseline-path .gitleaks-baseline.json
8392
```
8493

94+
**Understanding output:**
95+
- Exit code 0: No leaks detected
96+
- Exit code 1: Leaks detected (pipeline will fail)
97+
98+
**Common secret types detected:**
99+
- AWS keys, GCP keys, Azure keys
100+
- GitHub tokens, GitLab tokens
101+
- Database credentials
102+
- Private keys (RSA, SSH)
103+
- API keys and tokens
104+
85105
### Dependency Audit
86106

87107
```bash

‎docs/SECURITY.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ Tab Modifier uses multiple security scanning tools in the CI/CD pipeline to ensu
2727
### 4. Gitleaks Secret Scan
2828
- **Purpose**: Detects hardcoded secrets, API keys, and credentials
2929
- **Configuration**: `.github/workflows/ci.yml` - `gitleaks_scan` job
30+
- **Action**: Official `gitleaks/gitleaks-action@v2`
31+
- **Scope**: Full git history scan (`fetch-depth: 0`)
32+
- **Results**: Uploaded to GitHub Security Dashboard as SARIF
3033
- **Action on detection**: Pipeline fails if secrets are found
3134

3235
### 5. Dependency Vulnerability Audit

0 commit comments

Comments
 (0)