github-actions-cicd-sec/.github/workflows/dev.yml at dev · xcidic/github-actions-cicd-sec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: NodeJs CI-CD Security

on:
  push:
    branches: [dev]
  pull_request:
    branches: [dev]

env:
  NODE_VERSION: '18.x'
  SONAR_HOST_URL: 'http://sq.xcidic.com'
  ZAP_TARGET: 'https://dev-api.xcidic.com'
  ZAP_ISSUE: false
  ZAP_ISSUE_TITLE: 'ZAP CICD-SEC'
  ACTIONS_STEP_DEBUG: true

jobs:
  build-testing:
    runs-on: ubuntu-20.04
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Use Node.js ${{ env.NODE_VERSION }}
        uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Install dependencies
        run: yarn
      - run: yarn test

  mend-scanning:
    env:
      WS_APIKEY: ${{secrets.MEND_SCA_APIKEY}}
      WS_USERKEY: ${{secrets.MEND_SCA_USERKEY}}
      WS_WSS_URL: https://saas-eu.whitesourcesoftware.com/agent
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v3
      - name: Set up
        uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'yarn'
      - name: Mend Unified Agent Scan
        env:
          WS_PRODUCTNAME: ${{github.event.repository.name}}
          WS_PROJECTNAME: ${{github.event.repository.name}}_${{github.ref_name}}
          WS_GENERATEPROJECTDETAILSJSON: true
        run: |
          echo Downloading Mend Unified Agent
          curl -LJO https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar
          if [[ "$(curl -sL https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar.sha256)" != "$(sha256sum wss-unified-agent.jar)" ]] ; then
            echo "Integrity Check Failed"
          else
            echo "Integrity Check Passed"
            echo Starting Unified Agent Scan
            java -jar wss-unified-agent.jar
          fi
      - name: 'Upload WhiteSource folder'
        uses: actions/upload-artifact@v2
        with:
          name: Mend
          path: whitesource
          retention-days: 14
      - name: 'Upload Mend folder if failure'
        uses: actions/upload-artifact@v2
        if: failure()
        with:
          name: Mend
          path: whitesource
          retention-days: 14

  sonarqube-scanning:
    runs-on: ubuntu-20.04
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: Scan Actions
        id: scan
        uses: './.github/actions/security'
        with:
          is-sonar: true
          sonar-token: ${{ secrets.SONAR_TOKEN }}
          sonar-host-url: ${{ env.SONAR_HOST_URL }}
      - name: Security Actions Output
        if: ${{ always() }}
        run: |
          echo "Sonar validation error: ${{ steps.security.outputs.sonar-validation }}"
          echo "Sonar process error: ${{ steps.security.outputs.sonar-process }}"

  # deploy:
  #   needs: [build-testing, mend-scanning, sonarqube-scanning]
  #   runs-on: ubuntu-20.04
  #   steps:
  #     - name: Deploy using ssh
  #       uses: appleboy/ssh-action@v0.1.10
  #       with:
  #         host: ${{ secrets.DEPLOY_HOST }}
  #         username: ${{ secrets.DEPLOY_USER }}
  #         key: ${{ secrets.PRIVATE_KEY }}
  #         port: 22
  #         script: |
  #           cd ~/apps/github-actions-cicd-sec
  #           git pull origin dev
  #           git status
  #           yarn
  #           pm2 restart src/index.js

  # zap-scanning:
  #   runs-on: ubuntu-20.04
  #   needs: deploy
  #   steps:
  #     - name: Checkout
  #       uses: actions/checkout@v3
  #       with:
  #         fetch-depth: 0
  #     - name: ZAP Actions
  #       id: zap
  #       uses: './.github/actions/security'
  #       with:
  #         is-zap: 'false'
  #         zap-token: ${{ secrets.GITHUB_TOKEN }}
  #         zap-target: ${{ env.ZAP_TARGET }}
  #         zap-issue: ${{ env.ZAP_ISSUE }}
  #         zap-issue-title: ${{ env.ZAP_ISSUE_TITLE }}