Skip to content

Commit d163389

Browse files
rmkandarmkanda
committed
[Ramki] Refactoring job stages
1 parent b6f6779 commit d163389

File tree

4 files changed

+84
-33
lines changed

4 files changed

+84
-33
lines changed

‎.github/dependabot.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "maven"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"

‎.github/workflows/build.yaml renamed to ‎.github/workflows/ci.yaml

+59-26
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,26 @@ on:
77
branches: [ main ]
88

99
jobs:
10+
setup:
11+
name: Setup & Install
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v2
15+
- name: Set up JDK 11 (LTS)
16+
uses: actions/setup-java@v1
17+
with:
18+
java-version: 11
19+
architecture: x64
20+
- name: Restore Maven cache
21+
uses: actions/cache@v2
22+
with:
23+
path: ~/.m2
24+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
25+
restore-keys: ${{ runner.os }}-m2
26+
- run: java --version && mvn --version
27+
- name: Install Dependencies
28+
run: mvn install -DskipTests -Dspotbugs.skip=true -Ddependency-check.skip=true
29+
1030
secret-scan:
1131
name: Secret scanner
1232
runs-on: ubuntu-latest
@@ -28,6 +48,7 @@ jobs:
2848
build:
2949
name: Build & Unit Tests
3050
runs-on: ubuntu-latest
51+
needs: [ setup, secret-scan ]
3152
steps:
3253
- uses: actions/checkout@v2
3354
- name: Set up JDK 11 (LTS)
@@ -66,9 +87,9 @@ jobs:
6687
- run: echo ${{ steps.docker_build.outputs.digest }}
6788

6889
oss-scan:
69-
name: OSS Scan
90+
name: SCA - Dependency Checker
7091
runs-on: ubuntu-latest
71-
needs: build
92+
needs: [ setup, secret-scan ]
7293
steps:
7394
- uses: actions/checkout@v2
7495
- name: Run Snyk to check for vulnerabilities
@@ -78,6 +99,32 @@ jobs:
7899
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
79100
with:
80101
args: --severity-threshold=high
102+
103+
license_check:
104+
name: License Checker
105+
runs-on: ubuntu-latest
106+
needs: [ setup, secret-scan ]
107+
steps:
108+
- name: Checkout the code
109+
uses: actions/checkout@master
110+
- name: Set up JDK 11 (LTS)
111+
uses: actions/setup-java@v1
112+
with:
113+
java-version: 11
114+
architecture: x64
115+
- name: Restore Maven cache
116+
uses: actions/cache@v2
117+
with:
118+
path: ~/.m2
119+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
120+
restore-keys: ${{ runner.os }}-m2
121+
- uses: ruby/setup-ruby@v1
122+
with:
123+
ruby-version: 2.7.2
124+
bundler-cache: false
125+
- run: gem install license_finder
126+
- run: license_finder
127+
81128
sast:
82129
name: Static Code Analysis
83130
runs-on: ubuntu-latest
@@ -112,7 +159,7 @@ jobs:
112159
- name: Perform CodeQL Analysis
113160
uses: github/codeql-action/analyze@v1
114161

115-
container:
162+
container-scan:
116163
name: Scan Container Image
117164
runs-on: ubuntu-latest
118165
needs: build
@@ -128,6 +175,7 @@ jobs:
128175
uses: github/codeql-action/upload-sarif@v1
129176
with:
130177
sarif_file: ${{ steps.scan.outputs.sarif }}
178+
131179
container-lint:
132180
name: Lint Dockerfile
133181
runs-on: ubuntu-latest
@@ -138,6 +186,7 @@ jobs:
138186
image: ghcr.io/${{ github.repository }}/app:latest
139187
exit-code: '1'
140188
exit-level: FATAL
189+
141190
k8s-lint:
142191
name: K8s Hardening
143192
runs-on: ubuntu-latest
@@ -149,34 +198,18 @@ jobs:
149198
with:
150199
input: pod.yaml
151200
exit-code: "0"
152-
license_check:
153-
name: License Checker
201+
202+
deploy:
203+
name: Deploy to Test Environment
154204
runs-on: ubuntu-latest
155-
needs: build
205+
needs: [sast, container-scan, container-lint, k8s-lint, oss-scan, license_check ]
156206
steps:
157-
- name: Checkout the code
158-
uses: actions/checkout@master
159-
- name: Set up JDK 11 (LTS)
160-
uses: actions/setup-java@v1
161-
with:
162-
java-version: 11
163-
architecture: x64
164-
- name: Restore Maven cache
165-
uses: actions/cache@v2
166-
with:
167-
path: ~/.m2
168-
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
169-
restore-keys: ${{ runner.os }}-m2
170-
- uses: ruby/setup-ruby@v1
171-
with:
172-
ruby-version: 2.7.2
173-
bundler-cache: false
174-
- run: gem install license_finder
175-
- run: license_finder
207+
- run: echo done
208+
176209
dast:
177210
runs-on: ubuntu-latest
178211
name: DAST
179-
needs: build
212+
needs: deploy
180213
steps:
181214
- name: Checkout
182215
uses: actions/checkout@v2

‎README.md

+19-7
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,24 @@ Sample Secure Pipeline with GithHub Actions - Ideal for Open Source Projects
66

77
## Setup
88

9-
- Add SNYK API Token in GitHub Repositority Secrets
9+
- Add Snyk API Token in GitHub Repositority Secrets - SNYK_TOKEN
10+
- Add Git Guardian API Token for in GitHub Repositority Secrets - GITGUARDIAN_API_KEY
1011

11-
## Tools Used
12+
## Actions Used
1213

13-
| Stage | Tool | Comments | Open Source Alternative |
14-
| ------------------ | --------------------------------------------------- | -------- | ----------------------- |
15-
| Secrets Scanner | [truffleHog](https://github.com/dxa4481/truffleHog) | | |
16-
| Dependency Checker | [snyk](https://snyk.io/) | | |
17-
| | | | |
14+
| Step | Github Action | Comments | Open Source Alternative |
15+
| ------------------------ | ---------------------------------------------------------------------------------------- | -------- | --------------------------------------------------- |
16+
| Secrets Scanner | [GitGuardian](https://github.com/GitGuardian/gg-shield-action) | | [truffleHog](https://github.com/dxa4481/truffleHog) |
17+
| SCA - Dependency Checker | [snyk](https://github.com/marketplace/actions/snyk) | | OWASP Dependency Check |
18+
| Static Code Analysis | [Spot Bugs](https://github.com/jwgmeligmeyling/spotbugs-github-action) | | |
19+
| Static Code Analysis | [CodeQL](https://github.com/github/codeql-action) | | |
20+
| Container Scan | [Anchore](https://github.com/marketplace/actions/anchore-container-scan) | | |
21+
| Container Lint | [Dockle](https://github.com/marketplace/actions/runs-dockle) | | |
22+
| K8s Hardening | [Dockle](https://github.com/marketplace/actions/controlplane-kubesec) | | |
23+
| License Checker | [License finder](https://github.com/pivotal/LicenseFinder) | | |
24+
| DAST | [OWASP ZAP Basline Scan](https://github.com/marketplace/actions/owasp-zap-baseline-scan) | | |
25+
| | | | |
26+
27+
# Pipeline
28+
29+
![GitHub Pipeline](imgs/pipeline_light.png)

‎imgs/pipeline_light.png

107 KB
Loading

0 commit comments

Comments
 (0)