From 0c95f892a85e1ce565d55f1301eb98e25e7d8b81 Mon Sep 17 00:00:00 2001 From: Sylvia McLaughlin Date: Tue, 6 Aug 2024 15:34:39 -0700 Subject: [PATCH 1/4] Adding common CDS workflows --- .github/workflows/dependency-review.yml | 16 ++++++++ .github/workflows/export_github_data.yml | 25 +++++++++++++ .github/workflows/labels.yml | 10 +++++ .github/workflows/ossf-scorecard.yml | 47 ++++++++++++++++++++++++ .github/workflows/s3-backup.yml | 0 .github/workflows/shellcheck.yml | 21 +++++++++++ 6 files changed, 119 insertions(+) create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/export_github_data.yml create mode 100644 .github/workflows/labels.yml create mode 100644 .github/workflows/ossf-scorecard.yml create mode 100644 .github/workflows/s3-backup.yml create mode 100644 .github/workflows/shellcheck.yml diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 000000000..9f57d8480 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,16 @@ +name: Dependency review +on: + pull_request: + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + + - name: Dependency review + uses: actions/dependency-review-action@a9c83d3af6b9031e20feba03b904645bb23d1dab # v4.3.4 \ No newline at end of file diff --git a/.github/workflows/export_github_data.yml b/.github/workflows/export_github_data.yml new file mode 100644 index 000000000..88979f9e7 --- /dev/null +++ b/.github/workflows/export_github_data.yml @@ -0,0 +1,25 @@ +name: GitHub repository metadata exporter +on: + workflow_dispatch: + schedule: + - cron: "20 7 * * *" + +jobs: + export-data: + runs-on: ubuntu-latest + steps: + - name: Audit DNS requests + uses: cds-snc/dns-proxy-action@main + env: + DNS_PROXY_FORWARDTOSENTINEL: "true" + DNS_PROXY_LOGANALYTICSWORKSPACEID: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }} + DNS_PROXY_LOGANALYTICSSHAREDKEY: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }} + - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + - name: Export Data + uses: cds-snc/github-repository-metadata-exporter@main + with: + github-app-id: ${{ secrets.SRE_BOT_RO_APP_ID }} + github-app-installation-id: ${{ secrets.SRE_BOT_RO_INSTALLATION_ID }} + github-app-private-key: ${{ secrets.SRE_BOT_RO_PRIVATE_KEY }} + log-analytics-workspace-id: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }} + log-analytics-workspace-key: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }} \ No newline at end of file diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml new file mode 100644 index 000000000..e675925e0 --- /dev/null +++ b/.github/workflows/labels.yml @@ -0,0 +1,10 @@ +on: [issues, pull_request, workflow_dispatch] + +jobs: + sync-labels: + runs-on: ubuntu-latest + name: Sync repository labels + steps: + - uses: cds-snc/labels@v1 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml new file mode 100644 index 000000000..4b1087490 --- /dev/null +++ b/.github/workflows/ossf-scorecard.yml @@ -0,0 +1,47 @@ +name: Scorecards supply-chain security +on: + workflow_dispatch: + schedule: + # Weekly on Saturdays. + - cron: "30 1 * * 6" + push: + branches: + - main + +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + + steps: + - name: "Checkout code" + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 + with: + results_file: ossf-results.json + results_format: json + publish_results: false + + - name: "Add metadata" + run: | + full_repo="${{ github.repository }}" + OWNER=${full_repo%/*} + REPO=${full_repo#*/} + jq -c '. + {"metadata_owner": "'$OWNER'", "metadata_repo": "'$REPO'", "metadata_query": "ossf"}' ossf-results.json > ossf-results-modified.json + + - name: "Post results to Sentinel" + uses: cds-snc/sentinel-forward-data-action@main + with: + file_name: ossf-results-modified.json + log_type: GitHubMetadata_OSSF_Scorecard + log_analytics_workspace_id: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }} + log_analytics_workspace_key: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }} \ No newline at end of file diff --git a/.github/workflows/s3-backup.yml b/.github/workflows/s3-backup.yml new file mode 100644 index 000000000..e69de29bb diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml new file mode 100644 index 000000000..1736c8b2b --- /dev/null +++ b/.github/workflows/shellcheck.yml @@ -0,0 +1,21 @@ +name: Shellcheck +on: + push: + paths: + - "**/*.sh" + +jobs: + shellcheck: + runs-on: ubuntu-latest + steps: + - name: Audit DNS requests + uses: cds-snc/dns-proxy-action@main + env: + DNS_PROXY_FORWARDTOSENTINEL: "true" + DNS_PROXY_LOGANALYTICSWORKSPACEID: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }} + DNS_PROXY_LOGANALYTICSSHAREDKEY: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }} + + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 + - name: Shellcheck + run: | + .github/workflows/scripts/run-shellcheck.sh \ No newline at end of file From 919b83fdc972f177b1ec1a14651351c5d134e264 Mon Sep 17 00:00:00 2001 From: Sylvia McLaughlin Date: Tue, 6 Aug 2024 15:37:33 -0700 Subject: [PATCH 2/4] Adding the s3-backup github action --- .github/workflows/s3-backup.yml | 39 +++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/.github/workflows/s3-backup.yml b/.github/workflows/s3-backup.yml index e69de29bb..5b5a4ef3b 100644 --- a/.github/workflows/s3-backup.yml +++ b/.github/workflows/s3-backup.yml @@ -0,0 +1,39 @@ +name: S3 backup +on: + workflow_dispatch: + schedule: + - cron: "0 6 * * *" + +jobs: + s3-backup: + runs-on: ubuntu-latest + steps: + + - name: Checkout + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + fetch-depth: 0 # retrieve all history + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 + with: + aws-access-key-id: ${{ secrets.AWS_S3_BACKUP_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_S3_BACKUP_SECRET_ACCESS_KEY }} + aws-region: ca-central-1 + + - name: Create ZIP bundle + run: | + ZIP_FILE=`basename ${{ github.repository }}`-`date '+%Y-%m-%d'`.zip + zip -rq "${ZIP_FILE}" . + mkdir -p ${{ github.repository }} + mv "${ZIP_FILE}" ${{ github.repository }} + + - name: Upload to S3 bucket + run: | + aws s3 sync . s3://${{ secrets.AWS_S3_BACKUP_BUCKET }} --exclude='*' --include='${{ github.repository }}/*' + + - name: Notify Slack channel if this job failed + if: ${{ failure() }} + run: | + json='{"text":"S3 backup failed in !"}' + curl -X POST -H 'Content-type: application/json' --data "$json" ${{ secrets.SLACK_NOTIFY_WEBHOOK }} \ No newline at end of file From bc46f7b8ee7bf99039198d86e07eb00bcd0d5bb5 Mon Sep 17 00:00:00 2001 From: Sylvia McLaughlin Date: Tue, 6 Aug 2024 15:42:35 -0700 Subject: [PATCH 3/4] Adding the scripts folder that contains the script for hte shellcheck github action --- .github/workflows/scripts/run-shellcheck.sh | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .github/workflows/scripts/run-shellcheck.sh diff --git a/.github/workflows/scripts/run-shellcheck.sh b/.github/workflows/scripts/run-shellcheck.sh new file mode 100644 index 000000000..588e245ce --- /dev/null +++ b/.github/workflows/scripts/run-shellcheck.sh @@ -0,0 +1,3 @@ +#!/bin/bash + +docker run --rm -v "$PWD:/mnt" koalaman/shellcheck:v0.7.1 -P ./bin/ -x ./.github/workflows/scripts/*.sh \ No newline at end of file From ec301c6e0e122c0f9a8f80c6d35161a3f4b2ac30 Mon Sep 17 00:00:00 2001 From: Sylvia McLaughlin Date: Tue, 6 Aug 2024 16:09:56 -0700 Subject: [PATCH 4/4] Making the script executable --- .github/workflows/scripts/run-shellcheck.sh | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 .github/workflows/scripts/run-shellcheck.sh diff --git a/.github/workflows/scripts/run-shellcheck.sh b/.github/workflows/scripts/run-shellcheck.sh old mode 100644 new mode 100755