Merge pull request #7 from JamesJonesConsulting/develop

Code security scanning additions
JamesJonesConsulting · May 23, 2023 · 7c7e966 · 7c7e966
2 parents 767add8 + 4b59422
commit 7c7e966
Show file tree

Hide file tree

Showing 21 changed files with 494 additions and 121 deletions.
diff --git a/.github/actions/wine-build/Dockerfile.3.11.3 b/.github/actions/wine-build/Dockerfile.3.11.3
@@ -0,0 +1 @@
+FROM nexus.jamesjonesconsulting.com:5444/jamesjonesconsulting/wine-python-build-container/3.11.3:develop
diff --git a/.github/actions/wine-build/action.yaml b/.github/actions/wine-build/action.yaml
@@ -0,0 +1,29 @@
+# action.yml
+name: 'Generate Windows compatible binary'
+description: 'Creates the Python for Windows binary'
+inputs:
+  binary-basename:
+    description: 'Name of the output binary without extension'
+    required: true
+    default: 'voterwarehouse'
+  version:
+    description: 'Full path to script, including the script filename'
+    required: true
+    default: '1.0.0'
+  registry-proxy:
+    description: The proxy registry domain and port
+    required: true
+  python-version:
+    description: The version number of python for windows
+    required: true
+    default: '3.11.3'
+runs:
+  using: 'docker'
+  image: 'Dockerfile.wine.python'
+  entrypoint: 'entrypoint.sh'
+  env:
+    ARTIFACTORY: ${{ inputs.registry-proxy }}
+    PYTHON_VERSION: ${{ inputs.python-version }}
+  args:
+    - ${{ inputs.binary-basename }}
+    - ${{ inputs.version }}
diff --git a/.github/actions/wine-build/entrypoint.sh b/.github/actions/wine-build/entrypoint.sh
@@ -0,0 +1,9 @@
+#!/bin/sh -l
+
+BINARY_BASENAME=$1
+VERSION=$2
+
+/usr/bin/python -m pip install .
+/usr/bin/python build.py
+cd dist
+zip -rm "${BINARY_BASENAME}-${VERSION}-windows-x86_64.zip" "${BINARY_BASENAME}.exe"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -1,22 +1,38 @@
 name: Build VoterWarehouse
 on: push
-
+env:
+  registry-proxy: nexus.jamesjonesconsulting.com:5444
+  binary-basename: voterwarehouse
+  python-win-version: 3.11.3
 jobs:
   build-job:
     runs-on: self-hosted
     container:
-      image: quay.io/podman/stable:latest
+      image: nexus.jamesjonesconsulting.com:5444/podman/stable:latest
       options: --userns=keep-id --privileged --user root
-    steps:
-      # Downloads a copy of the code in your repository before running CI tests
-      - name: Check out repository code
-        uses: actions/checkout@v3
+      # options: --userns=keep-id --group-add keep-groups --privileged --user root --security-opt seccomp=unconfined
+      credentials:
+        username: ${{ secrets.HOME_NEXUS_DOCKER_USER }}
+        password: ${{ secrets.HOME_NEXUS_DOCKER_PASSWORD }}
 
+    steps:
       # Sets up RPM build tools and Ruby Gems
       - name: Install RPM dependencies
         run: |
           dnf install -y rpm-build rpm-sign rubygems ruby-devel gcc gcc-c++ make \
-            libffi-devel python3 python3-pip python3-virtualenv curl pinentry
+            libffi-devel python3 python3-pip python3-virtualenv python3-wheel upx wget curl pinentry
+
+      # Downloads a copy of the code in your repository before running CI tests
+      - name: Check out repository code
+        uses: actions/checkout@v3
+
+      - name: Docker Login
+        uses: azure/docker-login@v1
+        with:
+          login-server: ${{ env.registry-proxy }}
+          username: ${{ secrets.HOME_NEXUS_DOCKER_USER }}
+          password: ${{ secrets.HOME_NEXUS_DOCKER_PASSWORD }}
+
       # Sets up Rubygems packaging pinentry-program /usr/bin/pinentry-curses
       - name: Setup FPM with it's dependent package for building a package
         run: |
@@ -27,30 +43,54 @@ jobs:
         env:
           PC_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
       # Sets up the python virtual environment, pulls the requirements and builds the binary
-      - name: Build the binary
+      - name: Build the Linux and Windows binaries
         run: |
-          python3 -m venv venv
-          source venv/bin/activate
-          python -m pip install -r requirements.txt
+          python3 -m venv vwenv
+          source vwenv/bin/activate
+          python -m pip install .
           python build.py
-      - name: Build the RPM package
+          podman build --no-cache \
+            --build-arg PYTHON_VERSION=${{ env.python-win-version }} \
+            --build-arg ARTIFACTORY=${{ env.registry-proxy }} \
+            -f Dockerfile.wine.python \
+            -v "$(pwd):/work:Z" .
+      - name: Generate Versions
+        id: package-versions
         run: |
           if [[ "$GITHUB_REF" =~ ^refs/tags.* ]]; then
-            VERSION=$GITHUB_REF_NAME
+            echo "standard=$GITHUB_REF_NAME" >> $GITHUB_OUTPUT
+            echo "rpm=$GITHUB_REF_NAME" >> $GITHUB_OUTPUT
+            DEB_VER=$(echo "$GITHUB_REF_NAME" | sed 's|_|-|g')
+            echo "deb=$DEB_VER" >> $GITHUB_OUTPUT
           else
-            VERSION=$(./dist/voterwarehouse -v)
+            VERSION=$(./dist/${{ env.binary-basename }} -v)
             VERSION+=$(echo "~${GITHUB_REF_NAME}" | sed "s|/${VERSION}||g" | sed 's|/|-|g')
+            echo "standard=$VERSION" >> $GITHUB_OUTPUT
+            echo "rpm=$VERSION" >> $GITHUB_OUTPUT
+            DEB_VER=$(echo "$VERSION" | sed 's|_|-|g')
+            echo "deb=$DEB_VER" >> $GITHUB_OUTPUT
           fi
-          fpm -s dir -t rpm -n voterwarehouse -v ${VERSION} --iteration ${GITHUB_RUN_NUMBER} \
+#      - name: Build the Windows binary
+#        uses: "./.github/actions/wine-build"
+#        with:
+#          binary-basename: ${{ env.binary-basename }}
+#          version: ${{ steps.package-versions.outputs.standard }}
+#          registry-proxy: ${{ env.registry-proxy }}
+#          python-version: '3.11.3'
+      - name: Build the RPM package
+        run: |
+          fpm -s dir -t rpm -n ${{ env.binary-basename }} \
+            -v ${{ steps.package-versions.outputs.rpm }} \
+            --iteration ${GITHUB_RUN_NUMBER} \
             --description "VoterWarehouse: Imports and Extracts Voter and History data" \
             --url "https://github.com/JamesJonesConsulting/VoterWarehouse" \
             --license "LGPL-3.0" --vendor "James Jones" --maintainer "James Jones <[email protected]>" \
             --config-files /etc/VoterWarehouse/config.yml \
             -p ./dist \
-            ./dist/voterwarehouse=/usr/bin/voterwarehouse \
+            ./dist/${{ env.binary-basename }}=/usr/bin/${{ env.binary-basename }} \
             ./config.sample.yml=/etc/VoterWarehouse/config.yml
-          PACKAGE_FILE=$(find . -type f -name "voterwarehouse*.rpm")
-          rpm --import https://nexus.jamjon3.sytes.net/repository/gpg/RPM-GPG-KEY-JAMJON3
+          PACKAGE_FILE=$(find . -type f -name "${{ env.binary-basename }}*.rpm")
+          rpm --import https://nexus.jamesjonesconsulting.com/repository/gpg/RPM-GPG-KEY-JAMJON3
           echo "${{ secrets.JAMJON3_RPM_SIGN_GPG_KEY }}" | base64 -d > key.gpg
           echo "${{ secrets.JAMJON3_RPM_SIGN_GPG_SECRET_KEY }}" | base64 -d > private.gpg
           export GPG_TTY=$(tty)
@@ -66,31 +106,27 @@ jobs:
           PACKAGE_CLOUD_REPO: jamjon3/yum/rpm_any/rpm_any
           YUM_USER: ${{ secrets.HOME_NEXUS_YUM_USER }}
           YUM_PASSWORD: ${{ secrets.HOME_NEXUS_YUM_PASSWORD }}
-          NEXUS_YUM_REPO: https://nexus.jamjon3.sytes.net/repository/yum-hosted/voting/
+          NEXUS_YUM_REPO: https://nexus.jamesjonesconsulting.com/repository/yum-hosted/voting/
       - name: Build the DEB package
         run: |
-          if [[ "$GITHUB_REF" =~ ^refs/tags.* ]]; then
-            VERSION=$GITHUB_REF_NAME
-          else
-            VERSION=$(./dist/voterwarehouse -v)
-            # VERSION+=$(echo "~${GITHUB_REF_NAME}" | sed 's|/|-|g')
-            VERSION+=$(echo "~${GITHUB_REF_NAME}" | sed "s|/${VERSION}||g" | sed 's|/|-|g')
-          fi
-          fpm -s dir -t deb -n voterwarehouse -v ${VERSION} --iteration ${GITHUB_RUN_NUMBER} \
+          fpm -s dir -t deb -n ${{ env.binary-basename }} \
+            -v ${{ steps.package-versions.outputs.deb }} \
+            --iteration ${GITHUB_RUN_NUMBER} \
             --description "VoterWarehouse: Imports and Extracts Voter and History data" \
             --url "https://github.com/jamjon3/VoterWarehouse" \
             --license "LGPL-3.0" --vendor "James Jones" \
             --config-files /etc/VoterWarehouse/config.yml \
             -p ./dist \
-            ./dist/voterwarehouse=/usr/bin/voterwarehouse \
+            ./dist/${{ env.binary-basename }}=/usr/bin/${{ env.binary-basename }} \
             ./config.sample.yml=/etc/VoterWarehouse/config.yml
           echo "${{ secrets.JAMJON3_RPM_SIGN_GPG_KEY }}" | base64 -d > dist/key.gpg
           echo "${{ secrets.JAMJON3_RPM_SIGN_GPG_SECRET_KEY }}" | base64 -d > dist/private.gpg
           podman build --no-cache \
             --build-arg PRIVATE_KEY_PASS=${{ secrets.JAMJON3_RPM_SIGN_PASSPHRASE }} \
+            --build-arg REGISTRY_PROXY=${{ env.registry-proxy }} \
             -f Dockerfile.ubuntu \
             -v "$(pwd)/dist:/dist:Z" .
-          PACKAGE_FILE=$(find . -type f -name "voterwarehouse*.deb")          
+          PACKAGE_FILE=$(find . -type f -name "${{ env.binary-basename }}*.deb")          
           apt_repos=(
             apt-focal-hosted
           )
@@ -99,13 +135,32 @@ jobs:
             DATA_BINARY+="$PACKAGE_FILE"
             echo "$DATA_BINARY"
             echo "${NEXUS_APT_REPOSITORY_ROOT}${repo}/"
-            curl -u "${APT_USER}:${APT_PASSWORD}" -H "Content-Type: multipart/form-data" --data-binary "${DATA_BINARY}" "${NEXUS_APT_REPOSITORY_ROOT}${repo}/"
+            curl -u "${APT_USER}:${APT_PASSWORD}" \
+              -H "Content-Type: multipart/form-data" \
+              --data-binary "${DATA_BINARY}" "${NEXUS_APT_REPOSITORY_ROOT}${repo}/"
           done
           # package_cloud push $PACKAGE_CLOUD_REPO $PACKAGE_FILE
         shell: bash
         env:
           PACKAGE_CLOUD_REPO: jamjon3/deb/any/any
           APT_USER: ${{ secrets.HOME_NEXUS_APT_USER }}
           APT_PASSWORD: ${{ secrets.HOME_NEXUS_APT_PASSWORD }}
-          NEXUS_APT_REPOSITORY_ROOT: https://nexus.jamjon3.sytes.net/repository/
-
+          NEXUS_APT_REPOSITORY_ROOT: https://nexus.jamesjonesconsulting.com/repository/
+      - name: Create Zip Archives of the Linux/Windows CLI
+        run: |
+          cd dist
+          zip -rm "${{ env.binary-basename }}-${{ steps.package-versions.outputs.standard }}-linux-x86_64.zip" "${{ env.binary-basename }}"
+          zip -rm "${{ env.binary-basename }}-${{ steps.package-versions.outputs.standard }}-windows-x86_64.zip" "${{ env.binary-basename }}.exe"
+      - name: Archive tool artifacts
+        if: ${{ !startsWith(github.ref,'refs/tags/') }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: "${{ env.binary-basename }}-${{ steps.package-versions.outputs.standard }}"
+          path: |
+            dist
+      - name: Release tool artifacts
+        if: ${{ startsWith(github.ref,'refs/tags/') }}
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: "dist/*.*"
+          allowUpdates: true
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -0,0 +1,82 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+  schedule:
+    - cron: '22 22 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: self-hosted
+    container:
+      image: quay.io/podman/stable:latest
+      options: --userns=keep-id --privileged --user root
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+      # Sets up RPM build tools and Ruby Gems
+    - name: Install RPM dependencies
+      run: |
+        dnf install -y rpm-build rpm-sign rubygems ruby-devel gcc gcc-c++ make \
+          libffi-devel python3 python3-pip python3-virtualenv curl pinentry git
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines.
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      with:
+        category: "/language:${{matrix.language}}"