Skip to content

Commit 856ee00

Browse files
theangrytech-gittheangrytech-git
authored
Re-uploaded workflows as part of the repo
1 parent 95d64fb commit 856ee00

File tree

5 files changed

+520
-0
lines changed

5 files changed

+520
-0
lines changed

‎msdo-credscan.yml‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
name: msdo-secret-scanning-credscan
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
GH_TOKEN:
7+
required: false
8+
workflow_dispatch:
9+
10+
jobs:
11+
secret-scan:
12+
name: MSDO Secret Scan
13+
runs-on: ubuntu-latest
14+
15+
permissions:
16+
contents: read
17+
id-token: write
18+
actions: read
19+
security-events: write
20+
21+
steps:
22+
- name: Checkout repository manually
23+
run: |
24+
git clone https://github.com/${{ github.repository }} .
25+
git checkout ${{ github.ref_name }}
26+
27+
- name: Inject .gdnsettings to support secrets detection in Terraform, Bicep, ARM, Python, and YAML
28+
run: |
29+
mkdir -p .gdn
30+
cat <<EOF > .gdn/.gdnsettings
31+
{
32+
"version": "1.0",
33+
"fileFiltering": {
34+
"filePathIncludes": [
35+
"**/*.tf",
36+
"**/*.tfvars",
37+
"**/*.bicep",
38+
"**/*.json",
39+
"**/*template*.json",
40+
"**/*.py",
41+
"**/*.yml",
42+
"**/*.yaml"
43+
],
44+
"fileNameExcludes": [],
45+
"filePathExcludes": []
46+
},
47+
"toolConfigurations": {
48+
"credscan": {
49+
"enabled": true,
50+
"parameters": {
51+
"scanUnknownExtensions": true,
52+
"scanAllFiles": true,
53+
"severity": "low"
54+
}
55+
}
56+
},
57+
"break": {
58+
"policies": [
59+
{
60+
"tool": "credscan",
61+
"minimumSeverity": "low"
62+
}
63+
]
64+
}
65+
}
66+
EOF
67+
68+
- name: Set tool to only run secret scan
69+
run: echo "TOOLS=credscan" >> $GITHUB_ENV
70+
71+
- name: Install .NET 6 SDK (for CredScan)
72+
run: |
73+
wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh
74+
chmod +x dotnet-install.sh
75+
./dotnet-install.sh --version 6.0.415 --install-dir "$HOME/dotnet"
76+
77+
echo "DOTNET_ROOT=$HOME/dotnet" >> $GITHUB_ENV
78+
echo "$HOME/dotnet" >> $GITHUB_PATH
79+
80+
- name: Run Microsoft Security DevOps - Secret Scan
81+
uses: theangrytech-git/security-devops-action@main
82+
id: msdo
83+
with:
84+
tools: ${{ env.TOOLS }}
85+
86+
- name: Upload SARIF to GitHub Code Scanning
87+
if: github.repository_visibility == 'public'
88+
run: |
89+
echo "Compressing and uploading SARIF..."
90+
sarif_file="${{ steps.msdo.outputs.sarifFile }}"
91+
if [ ! -f "$sarif_file" ]; then
92+
echo "SARIF file not found at $sarif_file"
93+
exit 0
94+
fi
95+
96+
gzip -c "$sarif_file" | base64 -w 0 > msdo.sarif.base64
97+
encoded_sarif=$(cat msdo.sarif.base64)
98+
99+
curl -s -X POST \
100+
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
101+
-H "Accept: application/vnd.github+json" \
102+
-H "Content-Type: application/json" \
103+
https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs \
104+
-d @- <<EOF
105+
{
106+
"commit_sha": "${{ github.sha }}",
107+
"ref": "${{ github.ref }}",
108+
"sarif": "$encoded_sarif",
109+
"checkout_uri": "https://github.com/${{ github.repository }}",
110+
"tool_name": "MSDO-CredScan"
111+
}
112+
EOF
113+
114+
# - name: Alert to Microsoft Teams on secret detection
115+
# if: github.repository_visibility == 'public'
116+
# run: |
117+
# echo "Checking for CredScan findings in SARIF..."
118+
# gzip -cd msdo.sarif.base64 | base64 -d > decoded.sarif || true
119+
# findings=$(jq '.runs[].results | length' decoded.sarif 2>/dev/null || echo 0)
120+
121+
# if [ "$findings" -gt 0 ]; then
122+
# echo "\uD83D\uDEA8 Secrets detected: $findings"
123+
# curl -H 'Content-Type: application/json' -d '{
124+
# "title": "\u26A0\uFE0F MSDO CredScan Alert",
125+
# "text": "**Secrets detected in '${{ github.repository }}' on branch '${{ github.ref_name }}'**\nTotal findings: '"$findings"'"
126+
# }' ${{ secrets.TEAMS_WEBHOOK_URL }}
127+
# else
128+
# echo "\u2705 No secrets found."
129+
# fi

‎msdo-dynamic-scanning.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: msdo-dynamic-scanning
2+
3+
on:
4+
workflow_dispatch:
5+
workflow_call:
6+
inputs:
7+
branch:
8+
required: false
9+
type: string
10+
default: 'main'
11+
secrets:
12+
GH_TOKEN:
13+
required: false
14+
15+
jobs:
16+
msdo:
17+
name: Microsoft Security DevOps
18+
runs-on: ubuntu-latest
19+
20+
permissions:
21+
contents: read
22+
id-token: write
23+
actions: read
24+
security-events: write
25+
26+
steps:
27+
- name: Manually checkout repository (internal-safe)
28+
run: |
29+
git clone https://github.com/${{ github.repository }} .
30+
git checkout ${{ inputs.branch }}
31+
32+
- name: Set environment variables for tools
33+
shell: pwsh
34+
run: |
35+
$TOOLS = ""
36+
37+
if ((Get-ChildItem -Recurse -Include *.js, *.jsx, *.ts, *.tsx | Measure-Object).Count -gt 0) {
38+
$TOOLS += "eslint,"
39+
echo "ESLint enabled - JS/JSX/TS/TSX files detected."
40+
} else {
41+
echo "ESLint skipped - No JS/JSX/TS/TSX files found."
42+
}
43+
44+
if ((Get-ChildItem -Recurse -Include *.exe, *.dll | Measure-Object).Count -gt 0) {
45+
$TOOLS += "binskim,"
46+
echo "BinSkim enabled - EXE/DLL files detected."
47+
} else {
48+
echo "BinSkim skipped - No EXE/DLL files found."
49+
}
50+
51+
if ((Get-ChildItem -Recurse -Include *.py | Measure-Object).Count -gt 0) {
52+
$TOOLS += "bandit,"
53+
echo "Bandit enabled - Python files detected."
54+
} else {
55+
echo "Bandit skipped - No Python files found."
56+
}
57+
58+
if ((Get-ChildItem -Recurse -Include *.tf, *.json, *.yml, *.yaml, *.dockerfile, *.template, *.bicep | Measure-Object).Count -gt 0) {
59+
$TOOLS += "checkov,"
60+
echo "Checkov enabled - Terraform/JSON/YML/YAML/Dockerfiles/Templates/Bicep files detected."
61+
} else {
62+
echo "Checkov skipped - No Terraform/JSON/YML/YAML/Dockerfiles/Templates/Bicep files found."
63+
}
64+
65+
if ((Get-ChildItem -Recurse -Include *.json | Select-String 'resources' | Measure-Object).Count -gt 0) {
66+
$TOOLS += "templateanalyzer,"
67+
echo "Template Analyzer enabled - ARM templates detected."
68+
}
69+
70+
if ((Get-ChildItem -Recurse -Include *.bicep | Measure-Object).Count -gt 0) {
71+
$TOOLS += "templateanalyzer,"
72+
echo "Template Analyzer enabled - Bicep files detected."
73+
}
74+
75+
if ((Get-ChildItem -Recurse -Include *.tf, *.json, *.yml, *.yaml | Measure-Object).Count -gt 0) {
76+
$TOOLS += "terrascan,"
77+
echo "Terrascan enabled - Terraform/JSON/YML/YAML files detected."
78+
}
79+
80+
if ((Get-ChildItem -Recurse -Include Dockerfile | Measure-Object).Count -gt 0) {
81+
$TOOLS += "trivy,"
82+
echo "Trivy enabled - Dockerfiles detected."
83+
}
84+
85+
$TOOLS = $TOOLS.TrimEnd(',')
86+
87+
if ($TOOLS -eq "") {
88+
echo "No applicable tools found. The MSDO scan will be skipped."
89+
exit 0
90+
}
91+
92+
echo "TOOLS=$TOOLS" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8
93+
94+
- name: Run Microsoft Security DevOps
95+
uses: theangrytech-git/security-devops-action@main
96+
id: msdo
97+
with:
98+
tools: ${{ env.TOOLS }}
99+
100+
- name: Check Repository Visibility
101+
shell: bash
102+
run: |
103+
if [ "${{ github.repository_visibility }}" == "private" ]; then
104+
echo "This is a private repository. Code Scanning is not available unless GitHub Advanced Security (GHAS) is enabled."
105+
exit 0
106+
fi
107+
108+
- name: Upload SARIF to GitHub Code Scanning
109+
if: github.repository_visibility == 'public'
110+
run: |
111+
echo "Compressing and uploading SARIF..."
112+
sarif_file="${{ steps.msdo.outputs.sarifFile }}"
113+
if [ ! -f "$sarif_file" ]; then
114+
echo "SARIF file not found at $sarif_file"
115+
exit 0
116+
fi
117+
118+
gzip -c "$sarif_file" | base64 -w 0 > msdo.sarif.base64
119+
encoded_sarif=$(cat msdo.sarif.base64)
120+
121+
curl -s -X POST \
122+
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
123+
-H "Accept: application/vnd.github+json" \
124+
-H "Content-Type: application/json" \
125+
https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs \
126+
-d @- <<EOF
127+
{
128+
"commit_sha": "${{ github.sha }}",
129+
"ref": "${{ github.ref }}",
130+
"sarif": "$encoded_sarif",
131+
"checkout_uri": "https://github.com/${{ github.repository }}",
132+
"tool_name": "MSDO"
133+
}
134+
EOF

‎msdo-gitleaks.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: msdo-secret-scanning-gitleaks
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
branch:
7+
required: false
8+
type: string
9+
default: 'main'
10+
secrets:
11+
GH_TOKEN:
12+
required: false
13+
14+
jobs:
15+
gitleaks-scan:
16+
name: Gitleaks Secret Scan
17+
runs-on: ubuntu-latest
18+
19+
permissions:
20+
contents: read
21+
id-token: write
22+
actions: read
23+
security-events: write
24+
25+
steps:
26+
- name: Checkout repository manually
27+
run: |
28+
git clone https://github.com/${{ github.repository }} .
29+
git checkout ${{ github.ref_name }}
30+
31+
- name: Fetch Gitleaks config from MSDO
32+
#This section will need to be edited to match wherever the repo will be copied to
33+
run: |
34+
echo "Fetching .gitleaks.toml from MSDO repo..."
35+
curl -sSL https://raw.githubusercontent.com/theangrytech-git/MSDO/main/gitleaks.toml -o .gitleaks.toml
36+
37+
- name: Run Gitleaks
38+
run: |
39+
echo "Downloading Gitleaks..."
40+
curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz -o gitleaks.tar.gz
41+
tar -xzf gitleaks.tar.gz gitleaks
42+
chmod +x gitleaks
43+
./gitleaks version
44+
45+
echo " Running Gitleaks scan..."
46+
./gitleaks detect \
47+
--source=. \
48+
--config=.gitleaks.toml \
49+
--report-format sarif \
50+
--report-path=gitleaks.sarif \
51+
--exit-code 0
52+
53+
- name: Upload SARIF to GitHub Code Scanning
54+
if: github.repository_visibility == 'public'
55+
run: |
56+
echo "Compressing and uploading SARIF..."
57+
if [ ! -f "gitleaks.sarif" ]; then
58+
echo "SARIF file not found"
59+
exit 0
60+
fi
61+
62+
gzip -c gitleaks.sarif | base64 -w 0 > gitleaks.sarif.base64
63+
encoded_sarif=$(cat gitleaks.sarif.base64)
64+
65+
curl -s -X POST \
66+
-H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
67+
-H "Accept: application/vnd.github+json" \
68+
-H "Content-Type: application/json" \
69+
https://api.github.com/repos/${{ github.repository }}/code-scanning/sarifs \
70+
-d @- <<EOF
71+
{
72+
"commit_sha": "${{ github.sha }}",
73+
"ref": "${{ github.ref }}",
74+
"sarif": "$encoded_sarif",
75+
"checkout_uri": "https://github.com/${{ github.repository }}",
76+
"tool_name": "Gitleaks"
77+
}
78+
EOF

‎msdo-main-pipeline.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: msdo-main-pipeline
2+
3+
on:
4+
push:
5+
branches: [main]
6+
workflow_dispatch:
7+
8+
jobs:
9+
msdo-dynamic-scanning:
10+
uses: ./.github/workflows/msdo-dynamic-scanning.yml
11+
permissions:
12+
contents: read
13+
id-token: write
14+
actions: read
15+
security-events: write
16+
with:
17+
branch: main
18+
secrets:
19+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20+
21+
secret-scan-credscan:
22+
uses: ./.github/workflows/msdo-credscan.yml
23+
permissions:
24+
contents: read
25+
id-token: write
26+
actions: read
27+
security-events: write
28+
needs: msdo-dynamic-scanning
29+
30+
secret-scan-trufflehog:
31+
uses: ./.github/workflows/msdo-trufflehog.yml
32+
permissions:
33+
contents: read
34+
id-token: write
35+
actions: read
36+
security-events: write
37+
needs: secret-scan-credscan
38+
39+
secret-scan-gitleaks:
40+
uses: ./.github/workflows/msdo-gitleaks.yml
41+
permissions:
42+
contents: read
43+
id-token: write
44+
actions: read
45+
security-events: write
46+
needs: secret-scan-trufflehog

0 commit comments

Comments
 (0)