Skip to content

Commit 55be6ab

Browse files
kailash-bkailash-b
authored
Integrate rl-scanner (#335)
2 parents 8e7618f + e1d7a1a commit 55be6ab

File tree

3 files changed

+285
-11
lines changed

3 files changed

+285
-11
lines changed

‎.github/actions/rl-scanner/action.yml

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: 'Reversing Labs Scanner'
2+
description: 'Runs the Reversing Labs scanner on a specified artifact.'
3+
inputs:
4+
artifact-path:
5+
description: 'Path to the artifact to be scanned.'
6+
required: true
7+
version:
8+
description: 'Version of the artifact.'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: '3.10'
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: 'The outcome of the scan process.'
71+
value: ${{ env.scan-status }}

‎.github/workflows/release.yml

+131-11
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,20 @@ on:
66
- closed
77
workflow_dispatch:
88

9-
109
permissions:
1110
contents: write
11+
id-token: write
1212

1313
### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows` and append `@latest` after the common `dx-sdk-actions` repo is made public.
1414
### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
1515

1616
jobs:
17+
1718
build:
1819
name: Build
1920
runs-on: windows-latest
2021
environment: 'release'
2122
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
22-
2323
steps:
2424
- name: Checkout code
2525
uses: actions/checkout@v4
@@ -57,10 +57,130 @@ jobs:
5757
retention-days: 1
5858
compression-level: 9
5959

60+
rl-scanner-android:
61+
needs: build
62+
uses: ./.github/workflows/rl-secure.yml
63+
with:
64+
nuspec-file: "nuget/Auth0.OidcClient.Android.nuspec"
65+
artifact-name: "Auth0.OidcClient.Android.tgz"
66+
project-path: "src/Auth0.OidcClient.Android"
67+
secrets:
68+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
69+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
70+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
71+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
72+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
73+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
74+
75+
rl-scanner-androidx:
76+
needs: build
77+
uses: ./.github/workflows/rl-secure.yml
78+
with:
79+
nuspec-file: "nuget/Auth0.OidcClient.AndroidX.nuspec"
80+
artifact-name: "Auth0.OidcClient.AndroidX.tgz"
81+
project-path: "src/Auth0.OidcClient.AndroidX"
82+
secrets:
83+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
84+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
85+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
86+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
87+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
88+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
89+
90+
rl-scanner-iOS:
91+
needs: build
92+
uses: ./.github/workflows/rl-secure.yml
93+
with:
94+
nuspec-file: "nuget/Auth0.OidcClient.iOS.nuspec"
95+
artifact-name: "Auth0.OidcClient.iOS.tgz"
96+
project-path: "src/Auth0.OidcClient.iOS"
97+
secrets:
98+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
99+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
100+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
101+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
102+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
103+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
104+
105+
rl-scanner-core:
106+
needs: build
107+
uses: ./.github/workflows/rl-secure.yml
108+
with:
109+
nuspec-file: "nuget/Auth0.OidcClient.Core.nuspec"
110+
artifact-name: "Auth0.OidcClient.Core.tgz"
111+
project-path: "src/Auth0.OidcClient.Core"
112+
secrets:
113+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
114+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
115+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
116+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
117+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
118+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
119+
120+
rl-scanner-wpf:
121+
needs: build
122+
uses: ./.github/workflows/rl-secure.yml
123+
with:
124+
nuspec-file: "nuget/Auth0.OidcClient.WPF.nuspec"
125+
artifact-name: "Auth0.OidcClient.WPF.tgz"
126+
project-path: "src/Auth0.OidcClient.WPF"
127+
secrets:
128+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
129+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
130+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
131+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
132+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
133+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
134+
135+
rl-scanner-winforms:
136+
needs: build
137+
uses: ./.github/workflows/rl-secure.yml
138+
with:
139+
nuspec-file: "nuget/Auth0.OidcClient.WinForms.nuspec"
140+
artifact-name: "Auth0.OidcClient.WinForms.tgz"
141+
project-path: "src/Auth0.OidcClient.WinForms"
142+
secrets:
143+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
144+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
145+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
146+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
147+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
148+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
149+
150+
rl-scanner-uwp:
151+
needs: build
152+
uses: ./.github/workflows/rl-secure.yml
153+
with:
154+
nuspec-file: "nuget/Auth0.OidcClient.UWP.nuspec"
155+
artifact-name: "Auth0.OidcClient.UWP.tgz"
156+
project-path: "src/Auth0.OidcClient.UWP"
157+
secrets:
158+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
159+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
160+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
161+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
162+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
163+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
164+
165+
rl-scanner-maui:
166+
needs: build
167+
uses: ./.github/workflows/rl-secure.yml
168+
with:
169+
nuspec-file: "nuget/Auth0.OidcClient.MAUI.nuspec"
170+
artifact-name: "Auth0.OidcClient.MAUI.tgz"
171+
project-path: "src/Auth0.OidcClient.MAUI"
172+
secrets:
173+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
174+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
175+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
176+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
177+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
178+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
179+
60180
android:
61181
name: Android
62182
uses: ./.github/workflows/nuget-release.yml
63-
needs: build
183+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
64184
with:
65185
tag-prefix: 'android-'
66186
project-path: "src/Auth0.OidcClient.Android"
@@ -72,7 +192,7 @@ jobs:
72192
androidx:
73193
name: AndroidX
74194
uses: ./.github/workflows/nuget-release.yml
75-
needs: build
195+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
76196
with:
77197
tag-prefix: 'androidx-'
78198
project-path: "src/Auth0.OidcClient.AndroidX"
@@ -84,7 +204,7 @@ jobs:
84204
ios:
85205
name: iOS
86206
uses: ./.github/workflows/nuget-release.yml
87-
needs: build
207+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
88208
with:
89209
tag-prefix: 'ios-'
90210
project-path: "src/Auth0.OidcClient.iOS"
@@ -96,7 +216,7 @@ jobs:
96216
core:
97217
name: Core
98218
uses: ./.github/workflows/nuget-release.yml
99-
needs: build
219+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
100220
with:
101221
tag-prefix: 'core-'
102222
project-path: "src/Auth0.OidcClient.Core"
@@ -108,7 +228,7 @@ jobs:
108228
wpf:
109229
name: WPF
110230
uses: ./.github/workflows/nuget-release.yml
111-
needs: build
231+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
112232
with:
113233
tag-prefix: 'wpf-'
114234
project-path: "src/Auth0.OidcClient.WPF"
@@ -120,7 +240,7 @@ jobs:
120240
winforms:
121241
name: WinForms
122242
uses: ./.github/workflows/nuget-release.yml
123-
needs: build
243+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
124244
with:
125245
tag-prefix: 'winforms-'
126246
project-path: "src/Auth0.OidcClient.WinForms"
@@ -132,7 +252,7 @@ jobs:
132252
uwp:
133253
name: UWP
134254
uses: ./.github/workflows/nuget-release.yml
135-
needs: build
255+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
136256
with:
137257
tag-prefix: 'uwp-'
138258
project-path: "src/Auth0.OidcClient.UWP"
@@ -144,7 +264,7 @@ jobs:
144264
maui:
145265
name: MAUI
146266
uses: ./.github/workflows/nuget-release.yml
147-
needs: build
267+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
148268
with:
149269
tag-prefix: 'maui-'
150270
project-path: "src/Auth0.OidcClient.MAUI"
@@ -158,7 +278,7 @@ jobs:
158278
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
159279
runs-on: windows-latest
160280
environment: release
161-
needs: build
281+
needs: [rl-scanner-android,rl-scanner-androidx,rl-scanner-iOS,rl-scanner-core,rl-scanner-wpf,rl-scanner-winforms,rl-scanner-uwp,rl-scanner-maui]
162282

163283
steps:
164284
- name: Checkout code

‎.github/workflows/rl-secure.yml

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: RL-Secure Workflow
2+
run-name: rl-scanner
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
nuspec-file:
8+
type: string
9+
required: true
10+
artifact-name:
11+
type: string
12+
required: true
13+
project-path:
14+
type: string
15+
required: true
16+
secrets:
17+
RLSECURE_LICENSE:
18+
required: true
19+
RLSECURE_SITE_KEY:
20+
required: true
21+
SIGNAL_HANDLER_TOKEN:
22+
required: true
23+
PRODSEC_TOOLS_USER:
24+
required: true
25+
PRODSEC_TOOLS_TOKEN:
26+
required: true
27+
PRODSEC_TOOLS_ARN:
28+
required: true
29+
30+
jobs:
31+
rl-scanner:
32+
name: Run Reversing Labs scanner
33+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
34+
runs-on: ubuntu-latest
35+
outputs:
36+
scan-status: ${{ steps.rl-scan-conclusion.outcome }}
37+
38+
steps:
39+
- name: Checkout code
40+
uses: actions/checkout@v4
41+
with:
42+
fetch-depth: 0
43+
44+
- name: Setup .NET
45+
uses: actions/setup-dotnet@v3
46+
with:
47+
dotnet-version: 6.0.x
48+
49+
- uses: actions/download-artifact@v4
50+
with:
51+
path: './src'
52+
name: build
53+
54+
- name: Create NuGet packages
55+
shell: pwsh
56+
run: |
57+
nuget pack ${{ inputs.nuspec-file }} -OutputDirectory ${{ github.workspace }}/nuget
58+
59+
- name: Create tgz build artifact
60+
run: |
61+
tar -czvf ${{ github.workspace }}/${{ inputs.artifact-name }} ${{ github.workspace }}/nuget
62+
63+
- id: get_version
64+
uses: ./.github/actions/get-version
65+
with:
66+
working-directory: ${{ inputs.project-path }}
67+
68+
- name: Run RL Scanner
69+
id: rl-scan-conclusion
70+
uses: ./.github/actions/rl-scanner
71+
with:
72+
artifact-path: ${{ github.workspace }}/${{ inputs.artifact-name }}
73+
version: "${{ steps.get_version.outputs.version }}"
74+
env:
75+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
76+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
77+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
78+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
79+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
80+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
81+
82+
- name: Output scan result
83+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

0 commit comments

Comments
 (0)