Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add FINOS Security Actions #693

Merged
merged 17 commits into from
Nov 30, 2022
Merged

Add FINOS Security Actions #693

Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
f70b3fe
add security scanning action
TheJuanAndOnly99 Nov 16, 2022
9f2c880
remove working dir
TheJuanAndOnly99 Nov 16, 2022
3a51349
add semgrep action
TheJuanAndOnly99 Nov 16, 2022
88ad42d
test
TheJuanAndOnly99 Nov 16, 2022
371ea56
update deps
maoo Nov 17, 2022
9408f2a
rollback logback
maoo Nov 17, 2022
243135e
Merge pull request #2 from maoo/patch-1
TheJuanAndOnly99 Nov 18, 2022
95b13f1
trigger action
TheJuanAndOnly99 Nov 18, 2022
41bb5cf
Merge branch 'security-scanning' of github.com:TheJuanAndOnly99/symph…
TheJuanAndOnly99 Nov 18, 2022
b38dcb1
original deps
TheJuanAndOnly99 Nov 18, 2022
7ebd1d0
fix action
TheJuanAndOnly99 Nov 18, 2022
8650213
update action
TheJuanAndOnly99 Nov 18, 2022
31ea549
add dependecycheck
TheJuanAndOnly99 Nov 18, 2022
12c9709
fix commas
TheJuanAndOnly99 Nov 18, 2022
cb8cfbb
remove depcheck
TheJuanAndOnly99 Nov 18, 2022
4bec976
add renovate.json + change analyze to aggregate
TheJuanAndOnly99 Nov 23, 2022
1bf6541
change action to also trigger on PR
TheJuanAndOnly99 Nov 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/cve-scanning-gradle.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: CVE Scanning for Gradle

on:
push:
paths:
Copy link
Contributor

@symphony-soufiane symphony-soufiane Nov 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would prefer this action to run on every push/pull_request if it lasts a reasonable duration. WDYT?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, the documentation mentions "dependencyCheckUpdate" task to update NVD from NIST. Do we need to add it to be sure the NVD is uptodate?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @symphony-soufiane fair question. I think for a GitHub action it is not needed as the action does not cache any build artifacts.

As for the action to run on every push/pull/request. It seems it takes around ~6 min to complete. I have added the change to the action if you want to go ahead with it.

- '**/build.gradle'
- 'allow-list.xml'
- '.github/workflows/cve-scanning-gradle.yml'


jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up JDK 11
uses: actions/setup-java@v3
with:
java-version: '8'
distribution: 'adopt'
- name: Build with Gradle
run: ./gradlew build
- name: CVEs
run: ./gradlew dependencyCheckAnalyze
Copy link
Contributor

@symphony-soufiane symphony-soufiane Nov 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that 'dependencyCheckAggregate' should be used rather to scan all modules.
Running locally dependencyCheckAnalyze showed in the report "Dependencies Scanned: 0 (0 unique)" while with 'dependencyCheckAggregate' I can see 'Dependencies Scanned: 151 (151 unique)'

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, in multi-module project, Aggregate should be the one to use.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @symphony-soufiane and @yinan-symphony! I've changed it in the PR. As you can see there are a few CVEs. Can you please take a look. If they are safe to ignore you can use the allow-list.xml file to do so.


15 changes: 15 additions & 0 deletions .github/workflows/semgrep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: Static code analysis

on: [push, pull_request]

jobs:
semgrep:
name: run-semgrep
runs-on: ubuntu-20.04
container:
image: returntocorp/semgrep
steps:
- uses: actions/checkout@v3
- run: semgrep scan --error --config auto
env:
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
4 changes: 4 additions & 0 deletions allow-list.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">

</suppressions>
6 changes: 6 additions & 0 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
plugins {
id "io.codearte.nexus-staging" version "0.22.0"
id "org.owasp.dependencycheck" version "7.3.2"
}

ext.projectVersion = '2.12.0-SNAPSHOT'
Expand Down Expand Up @@ -48,3 +49,8 @@ nexusStaging {
repositories {
mavenCentral()
}

dependencyCheck {
failBuildOnCVSS=5
suppressionFile="./allow-list.xml"
}
2 changes: 1 addition & 1 deletion symphony-bdk-bom/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,4 +120,4 @@ publishing {
signing {
required { rootProject.isReleaseVersion }
sign publishing.publications.bom
}
}