diff --git a/.github/workflows/bench.yaml b/.github/workflows/bench.yaml new file mode 100644 index 0000000..1ae15e5 --- /dev/null +++ b/.github/workflows/bench.yaml @@ -0,0 +1,43 @@ +# SPDX-License-Identifier: Apache-2.0 + +name: Benchmark CI +env: + GITHUB_TOKEN: ${{ secrets.GH_WRITE_TOKEN }} + REPO_NAME: 'performance-benchmark' + PROCCESSOR_REPO_NAME: ${{ github.event.repository.name }} +on: + push: + branches: + - 'main' +jobs: + bench: + runs-on: ubuntu-latest + steps: + - name: Clone repo + run: | + git clone https://user:$GITHUB_TOKEN@github.com/${{ github.repository_owner }}/${{ env.REPO_NAME }} + cd ${{ env.REPO_NAME }} + git config --local user.email "action@github.com" + git config --local user.name "GitHub Action" + - name: Switch to temp branch + run: | + cd ${{ env.REPO_NAME }} + git checkout temp-holder + git pull + cat "${{ env.PROCCESSOR_REPO_NAME }}".csv >> "${{ env.PROCCESSOR_REPO_NAME }}".csv.tmp + git add "${{ env.PROCCESSOR_REPO_NAME }}".csv.tmp + git stash + git checkout main + git stash apply + - name: Write data + run: | + cd ${{ env.REPO_NAME }} + echo -n $'\n' >> "${{ env.PROCCESSOR_REPO_NAME }}".csv + cat "${{ env.PROCCESSOR_REPO_NAME }}".csv.tmp >> "${{ env.PROCCESSOR_REPO_NAME }}".csv + git reset "${{ env.PROCCESSOR_REPO_NAME }}".csv.tmp + git add "${{ env.PROCCESSOR_REPO_NAME }}".csv + git commit -m "#${{ github.event.number }} Pushed update of ${{ env.PROCCESSOR_REPO_NAME }}" + - name: push data + run: | + cd ${{ env.REPO_NAME }} + git push origin main \ No newline at end of file diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml index 251c213..500f7d3 100644 --- a/.github/workflows/codacy.yml +++ b/.github/workflows/codacy.yml @@ -1,3 +1,5 @@ +# SPDX-License-Identifier: Apache-2.0 + # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support @@ -15,10 +17,10 @@ name: Codacy Security Scan on: push: - branches: [ "main" ] + branches: [ "dev", "main" ] pull_request: # The branches below must be a subset of the branches above - branches: [ "main" ] + branches: [ "dev", "main" ] schedule: - cron: '17 0 * * 4' @@ -40,7 +42,7 @@ jobs: # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis - name: Run Codacy Analysis CLI - uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b + uses: codacy/codacy-analysis-cli-action@3ff8e64eb4b714c4bee91b7b4eea31c6fc2c4f93 with: # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository # You can also omit the token and run the tools that support default configurations @@ -56,6 +58,6 @@ jobs: # Upload the SARIF file generated in the previous step - name: Upload SARIF results file - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: results.sarif diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b6aaf52..88abae3 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,5 @@ +# SPDX-License-Identifier: Apache-2.0 + # For most projects, this workflow file will not need changing; you simply need # to commit it to your repository. # @@ -13,10 +15,10 @@ name: "CodeQL" on: push: - branches: [ "main" ] + branches: [ "dev", "main" ] pull_request: # The branches below must be a subset of the branches above - branches: [ "main" ] + branches: [ "dev", "main" ] schedule: - cron: '34 0 * * 4' @@ -44,7 +46,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -58,7 +60,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v2 + uses: github/codeql-action/autobuild@v3 # โ„น๏ธ Command-line programs to run using the OS shell. # ๐Ÿ“š See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun @@ -71,6 +73,6 @@ jobs: # ./location_of_script_within_repo/buildscript.sh - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 + uses: github/codeql-action/analyze@v3 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml new file mode 100644 index 0000000..68efbd2 --- /dev/null +++ b/.github/workflows/conventional-commits.yml @@ -0,0 +1,33 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This GitHub Actions workflow validates the title of pull requests (PRs) to ensure they follow conventional commit standards. + +name: PR Conventional Commit Validation + +on: + # Trigger this workflow on specific events related to pull requests + pull_request: + types: [opened, synchronize, reopened, edited] + +jobs: + validate-pr-title: + runs-on: ubuntu-latest # Use the latest Ubuntu runner for the job + steps: + - name: Checkout code + uses: actions/checkout@v4 # Checkout the repository code using the actions/checkout action + + - name: PR Conventional Commit Validation + uses: ytanikin/PRConventionalCommits@1.1.0 # Use the PRConventionalCommits action to validate PR titles + with: + # Define the task types that are valid for conventional commits + task_types: '["build","ci","docs","feat","fix","perf","refactor","style","test","feat!"]' + # Map the conventional commit types to corresponding GitHub labels + custom_labels: '{"build": "build", "ci": "CI/CD", "docs": "documentation", "feat": "enhancement", "fix": "bug", "perf": "performance", "refactor": "refactor", "style": "style", "test": "test", "feat!": "enhancement breaking change"}' + # Use a personal access token (GITHUB_TOKEN) stored in GitHub secrets for authentication + token: ${{ secrets.GITHUB_TOKEN }} + add_label: 'true' diff --git a/.github/workflows/dco-check.yaml b/.github/workflows/dco-check.yaml new file mode 100644 index 0000000..af42602 --- /dev/null +++ b/.github/workflows/dco-check.yaml @@ -0,0 +1,54 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This GitHub Actions workflow checks that all commits in a pull request (PR) have a "Signed-off-by" line to ensure Developer Certificate of Origin (DCO) compliance. + +name: DCO + +# Trigger the workflow on pull request events +on: [pull_request] + +jobs: + dco: + # Define the runner environment + runs-on: ubuntu-latest + + steps: + # Step to check out the repository + - uses: actions/checkout@v4 + with: + fetch-depth: 0 # Fetch all history for all branches to ensure complete commit history is available + + - name: Set up environment variables + run: | + echo "BASE_BRANCH=${{ github.event.pull_request.base.ref }}" >> $GITHUB_ENV + echo "HEAD_BRANCH=${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV + + # Step to check each commit in the pull request for a Signed-off-by line + - name: Check for DCO Sign-off + run: | + # Get the base branch and head branch of the pull request + base_branch=$BASE_BRANCH + head_branch=$HEAD_BRANCH + + # Get the list of commit hashes between the head branch and base branch + commits=$(git log --pretty=format:%H origin/${head_branch}..origin/${base_branch}) + non_compliant_commits="" + + # Loop through each commit and check for the Signed-off-by line + for commit in $commits; do + # Check if the commit message contains the Signed-off-by line + if ! git show --quiet --format=%B $commit | grep -q "^Signed-off-by: "; then + # If not, add the commit hash to the list of non-compliant commits + non_compliant_commits="$non_compliant_commits $commit" + fi + done + + # If there are any non-compliant commits, output their hashes and fail the job + if [ -n "$non_compliant_commits" ]; then + echo "The following commits do not have a Signed-off-by line:" + for commit in $non_compliant_commits; do + echo "- $commit" + done + exit 1 + fi + shell: bash diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 4e75197..b8a269e 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -1,3 +1,5 @@ +# SPDX-License-Identifier: Apache-2.0 + # Dependency Review Action # # This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging. @@ -17,4 +19,4 @@ jobs: - name: 'Checkout Repository' uses: actions/checkout@v4 - name: 'Dependency Review' - uses: actions/dependency-review-action@v3 + uses: actions/dependency-review-action@v4 diff --git a/.github/workflows/dockerfile-linter.yaml b/.github/workflows/dockerfile-linter.yaml new file mode 100644 index 0000000..89f8cb4 --- /dev/null +++ b/.github/workflows/dockerfile-linter.yaml @@ -0,0 +1,49 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# hadoint is a Dockerfile linter written in Haskell +# that helps you build best practice Docker images. +# More details at https://github.com/hadolint/hadolint + +name: Hadolint + +on: + push: + branches: [ "dev", "main" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "dev" ] + schedule: + - cron: '17 13 * * 0' + +permissions: + contents: read + +jobs: + hadolint: + name: Run hadolint scanning + runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run hadolint + uses: hadolint/hadolint-action@f988afea3da57ee48710a9795b6bb677cc901183 + with: + dockerfile: ./Dockerfile + format: sarif + output-file: hadolint-results.sarif + no-fail: true + + - name: Upload analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: hadolint-results.sarif + wait-for-processing: true \ No newline at end of file diff --git a/.github/workflows/dockerhub-image-build.yaml b/.github/workflows/dockerhub-image-build.yaml new file mode 100644 index 0000000..dbf7b8f --- /dev/null +++ b/.github/workflows/dockerhub-image-build.yaml @@ -0,0 +1,60 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# GitHub recommends pinning actions to a commit SHA. +# To get a newer version, you will need to update the SHA. +# You can also reference a tag or branch, but the action may change without warning. + +name: Publish Docker image + +on: + release: + types: [published] + +jobs: + push_to_registry: + name: Push Docker image to Docker Hub + runs-on: ubuntu-latest + permissions: + packages: write + contents: read + attestations: write + id-token: write + steps: + - name: Check out the repo + uses: actions/checkout@v4 + + - name: Log in to Docker Hub + uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a + with: + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKER_PASSWORD }} + + - name: Extract metadata (tags, labels) for Docker + id: meta + uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7 + with: + images: my-docker-hub-namespace/my-docker-hub-repository + + - name: Build and push Docker image + id: push + uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 + with: + context: . + file: ./Dockerfile + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + + + * name: Generate artifact attestation + uses: actions/attest-build-provenance@v1 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true + diff --git a/.github/workflows/gpg-verify.yml b/.github/workflows/gpg-verify.yml new file mode 100644 index 0000000..9c0ab8f --- /dev/null +++ b/.github/workflows/gpg-verify.yml @@ -0,0 +1,40 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This GitHub Actions workflow checks that all commits in a pull request (PR) have been verified with GPG signatures. + +name: GPG Verify + +on: [pull_request] # Trigger this workflow on pull request events + +jobs: + gpg-verify: + runs-on: ubuntu-latest # Use the latest Ubuntu runner for the job + steps: + - uses: actions/checkout@v4 # Checkout the repository code using the actions/checkout action + with: + fetch-depth: 0 # Fetch all history for all branches to ensure we have the full commit history + + - name: Set up environment variables + run: | + echo "PR_HEAD_REF=${{ github.event.pull_request.head.ref }}" >> $GITHUB_ENV + echo "PR_BASE_REF=${{ github.event.pull_request.base.ref }}" >> $GITHUB_ENV + echo "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV + echo "GITHUB_REPOSITORY=${{ github.repository }}" >> $GITHUB_ENV + + - name: Check GPG verification status # Step to check each commit for GPG signature verification + run: | + # Get the list of commits in the pull request + commits=$(git log --pretty=format:%H origin/${PR_HEAD_REF}..origin/${PR_BASE_REF}) + + # Check the GPG verification status of each commit + for commit in $commits; do + status=$(curl -s -H "Authorization: token $GITHUB_TOKEN" \ + https://api.github.com/repos/$GITHUB_REPOSITORY/commits/$commit/check-runs \ + | jq -r '.check_runs[] | select(.name == "GPG verify") | .conclusion') + + # If the GPG verification status is not successful, list the commit and exit with a non-zero status + if [[ "$status" != "success" ]]; then + echo "GPG signature verification failed for commit $commit." + exit 1 + fi + done diff --git a/.github/workflows/milestone.yaml b/.github/workflows/milestone.yaml new file mode 100644 index 0000000..841ee2c --- /dev/null +++ b/.github/workflows/milestone.yaml @@ -0,0 +1,71 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This GitHub Actions workflow is designed to close a milestone and trigger a release workflow. + +name: Milestone Workflow + +# This workflow can be manually triggered with a specified milestone ID. +on: + workflow_dispatch: + inputs: + milestoneId: + description: 'Milestone ID' + required: true + default: '1' + +jobs: + close_milestone: + runs-on: ubuntu-latest + + steps: + # Step to check out the repository code. + - name: Checkout Repository + uses: actions/checkout@v2 + + # Step to set up Node.js environment, required for running npm commands. + - name: Setup Node.js (.npmrc) + uses: actions/setup-node@v3 + with: + node-version: 16.x + registry-url: https://npm.pkg.github.com/ + # Scope is set to the user or organization that owns the workflow file. + scope: '@frmscoe' + + # Step to install npm dependencies using the `npm ci` command. + - name: Install dependencies + run: npm ci + env: + GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + + # Step to set up environment variables required for the script. + - name: Set up environment variables + run: | + # Set the GitHub token for authentication. + echo "ACCESS_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV + # Set the milestone number based on the workflow input. + echo "MILESTONE_NUMBER=${{ github.event.inputs.milestoneId }}" >> $GITHUB_ENV + # Set the base API URL for GitHub. + echo "API_URL=https://api.github.com" >> $GITHUB_ENV + + # Step to close the specified milestone using GitHub API. + - name: Close Milestone + run: | + # Use the environment variables set up earlier to make the API call. + curl -X PATCH \ + -H "Accept: application/vnd.github.v3+json" \ + -H "Authorization: Bearer $ACCESS_TOKEN" \ + -d '{"state": "closed"}' \ + $API_URL/repos/${{ github.repository }}/milestones/$MILESTONE_NUMBER + env: + ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }} + MILESTONE_NUMBER: ${{ github.event.inputs.milestoneId }} + API_URL: "https://api.github.com" + + # Step to trigger another workflow for releasing, passing the milestone number. + - name: Trigger Release Workflow + uses: peter-evans/repository-dispatch@v1 + with: + token: ${{ secrets.GITHUB_TOKEN }} + repository: ${{ github.repository }} + event-type: release + client-payload: '{"milestone_number": "${{ github.event.inputs.milestoneId }}"}' diff --git a/.github/workflows/njsscan.yml b/.github/workflows/njsscan.yml index 1f2a970..255c0f7 100644 --- a/.github/workflows/njsscan.yml +++ b/.github/workflows/njsscan.yml @@ -1,3 +1,5 @@ +# SPDX-License-Identifier: Apache-2.0 + # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support @@ -10,10 +12,10 @@ name: njsscan sarif on: push: - branches: [ "main" ] + branches: [ "dev", "main" ] pull_request: # The branches below must be a subset of the branches above - branches: [ "main" ] + branches: [ "dev", "main" ] schedule: - cron: '17 17 * * 1' @@ -37,6 +39,6 @@ jobs: with: args: '. --sarif --output results.sarif || true' - name: Upload njsscan report - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: results.sarif diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml index e4375dd..10aa456 100644 --- a/.github/workflows/node.js.yml +++ b/.github/workflows/node.js.yml @@ -1,240 +1,46 @@ +# SPDX-License-Identifier: Apache-2.0 + # This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node # For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs name: Node.js CI + env: - NODE_ENV: 'dev' - STARTUP_TYPE: 'nats' - SERVER_URL: 'nats://localhost:4222' - PRODUCER_STREAM: event-director - CONSUMER_STREAM: TMS - ACK_POLICY: 'None' - STREAM_SUBJECT: - APM_ACTIVE: false - APM_LOGGING: false - FUNCTION_NAME: '${{ github.event.repository.name }}' - REDIS_DB: 0 - REDIS_AUTH: - REDIS_SERVERS: '[{"host":"127.0.0.1", "port":6379}]' - REDIS_IS_CLUSTER: false - DATABASE_NAME: Configuration - TRANSACTION_HISTORY_DATABASE_URL: 'http://localhost:8529/' - PSEUDONYMS_DATABASE_URL: 'http://localhost:8529/' - TRANSACTION_HISTORY_DATABASE_USER: root - PSEUDONYMS_DATABASE_USER: root - TRANSACTION_HISTORY_DATABASE_PASSWORD: - PSEUDONYMS_DATABASE_PASSWORD: - PSEUDONYMS_DATABASE: pseudonyms - TRANSACTION_HISTORY_DATABASE: transactionHistory - TRANSACTION_HISTORY_DATABASE_CERT_PATH: '' - PSEUDONYMS_DATABASE_CERT_PATH: '' - NODE_TLS_REJECT_UNAUTHORIZED: '0' - TRANSACTION_HISTORY_PAIN001_COLLECTION: transactionHistoryPain001 - TRANSACTION_HISTORY_PAIN013_COLLECTION: transactionHistoryPain013 - TRANSACTION_HISTORY_PACS008_COLLECTION: transactionHistoryPacs008 - TRANSACTION_HISTORY_PACS002_COLLECTION: transactionHistoryPacs002 - QUOTING: true - PORT: 3000 - GH_RW_TOKEN: '${{ secrets.GH_WRITE_TOKEN }}' - GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}' + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_SCOPE: "@frmscoe" NPM_REGISTRY: "https://npm.pkg.github.com/" - ENV_NEWMAN: https://raw.githubusercontent.com/frmscoe/postman/indexes/environments/Ekuta-LOCAL.postman_environment.json - THRESHOLD: 5 - REPO_NAME: 'performance-benchmark' - ITERATION_COUNT: 500 + NODE_ENV: 'test' + STARTUP_TYPE: 'nats' + on: push: - branches: [ "main" ] + branches: [ "dev", "main" ] pull_request: - branches: [ "main" ] + branches: [ "dev", "main" ] jobs: build: runs-on: ubuntu-latest - outputs: - responseAverage: ${{ steps.newman_test.outputs.responseAverage }} - responseMin: ${{ steps.newman_test.outputs.responseMin }} - responseMax: ${{ steps.newman_test.outputs.responseMax }} - responseSd: ${{ steps.newman_test.outputs.responseSd }} - numberOfTest: ${{ steps.newman_test.outputs.numberOfTest }} - resultOutput: ${{ steps.output_test.outputs.resultOutput}} - name: integration test - permissions: - packages: write - contents: read + name: run build strategy: matrix: - node-version: [20] - redis-version: [6] + node-version: [16, 20] steps: - uses: actions/checkout@v4 - - name: Start Arango - uses: xinova/arangodb-action@v1 - with: - arangodb version: 'latest' - - - name: Setup Arango - run: newman run https://raw.githubusercontent.com/frmscoe/postman/indexes/ArangoDB%20Setup.json -e ${{ env.ENV_NEWMAN }} --timeout-request 10200 - - - name: Startup Nats - uses: onichandame/nats-action@master - with: - port: 4222 - - - name: Startup Redis - uses: supercharge/redis-github-action@1.7.0 - with: - redis-version: ${{ matrix.redis-version }} - - - name: Setup Node.js (.npmrc) - uses: actions/setup-node@v3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v4 with: - node-version: 20.x - registry-url: https://npm.pkg.github.com/ - scope: '@frmscoe' - - - name: Install dependencies + node-version: ${{ matrix.node-version }} + cache: 'npm' + registry-url: ${{ env.NPM_REGISTRY }} + scope: ${{ env.NPM_SCOPE }} + - name: Install dependencies run: npm ci - - - name: Processor Build + - name: Run build run: npm run build - - name: Processor Start - run: npm run start & - - - name: Test Processor - run: newman run https://raw.githubusercontent.com/frmscoe/postman/main/micro_processors/TransactionMessageSubmitterProcessor_Proxt_Test.postman_collection.json --iteration-count ${{ env.ITERATION_COUNT }} -e ${{ env.ENV_NEWMAN }} --timeout-request 10200 -r json --reporter-json-export fullReport.json - - - name: Extract Specific Field - id: newman_test - run: | - echo "::set-output name=responseAverage::$(jq -r '.run.timings.responseAverage' fullReport.json)" - echo "::set-output name=responseMin::$(jq -r '.run.timings.responseMin' fullReport.json)" - echo "::set-output name=responseMax::$(jq -r '.run.timings.responseMax' fullReport.json)" - echo "::set-output name=responseSd::$(jq -r '.run.timings.responseSd' fullReport.json)" - echo "::set-output name=numberOfTest::$(jq -r '.run.stats.iterations.total' fullReport.json)" - - - name: Get Results For each test - id: output_test - run: | - result="
" - array_length=$(jq '.collection.item | length' fullReport.json) - for ((index=0; index> "$CHANGELOG_FILE" diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml new file mode 100644 index 0000000..b21d884 --- /dev/null +++ b/.github/workflows/scorecard.yaml @@ -0,0 +1,75 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '35 3 * * 3' + push: + branches: [ "dev", "main" ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read + + steps: + - name: "Checkout code" + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecard on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9 + with: + sarif_file: results.sarif \ No newline at end of file diff --git a/.github/workflows/terraform-security.yaml b/.github/workflows/terraform-security.yaml new file mode 100644 index 0000000..ea0b88e --- /dev/null +++ b/.github/workflows/terraform-security.yaml @@ -0,0 +1,40 @@ +# SPDX-License-Identifier: Apache-2.0 + +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: tfsec + +on: + push: + branches: [ "dev", "main" ] + pull_request: + branches: [ "dev" ] + schedule: + - cron: '31 11 * * 1' + +jobs: + tfsec: + name: Run tfsec sarif report + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + steps: + - name: Clone repo + uses: actions/checkout@v4 + + - name: Run tfsec + uses: aquasecurity/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608 + with: + sarif_file: tfsec.sarif + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: tfsec.sarif