config.yml

title: Security strategy essentials
description: Learn security best practices and keep your project’s contributions—and contributors—safe.
template:
  repo: security-strategy-essentials-template
  name: security-strategy-essentials
before:
  - type: updateBranchProtection
  - type: createPullRequest
    title: Update the vulnerable dependency
    body: 03_update-dependency.md
    head: update-dependency
  - type: octokit
    method: 'repos.get'
    owner: '%payload.repository.owner.login%'
    repo: '%payload.repository.name%'
    action_id: gotten_repo
  - type: createIssue
    title: Welcome
    body: 00_introduction-issue.md
    data:
      private: '%actions.gotten_repo.data.private%'
    store:
      welcomeIssueNumber: '{{ result.data.number }}'

steps:

  # Step 1:
  # Learner enables GH pages for game
  # Bot creates issue to report a vulnerability

  - title: Enable repository settings
    description: Enable settings in your repository for the next activities.
    event: page_build
    link: '{{ repoUrl }}/issues/2'
    actions:
      - type: createIssue
        title: Find repository vulnerabilities
        body: 01_find-vulnerabilities.md
        action_id: firstIssue
      - type: closeIssue
        issue: '{{ store.welcomeIssueNumber }}'
      - type: octokit
        method: repos.getPages
        owner: '%payload.repository.owner.login%'
        repo: '%payload.repository.name%'
        action_id: pagesUrl
      - type: respond
        issue: Welcome
        with: 01_closed-issue.md
        data:
          url: '%actions.firstIssue.data.html_url%'
          pagesUrl: '%actions.pagesUrl.data.html_url%'

  # Step 2
  # Learner comments on issue with the recommended updated version
  # Bot closes issue and responds with making change in PR

  - title: Find the vulnerable dependency
    description: Find the vulnerable dependency, and comment with the suggested update version.
    event: issue_comment.created
    link: '{{ repoUrl }}/issues/3'
    actions:
      - type: respond
        with: 02_found-vulnerability.md
      - type: closeIssue
        issue: Find repository vulnerabilities

  # Step 3
  # Learner updates the dependency
  # Bot responds

  - title: Update the dependency version
    description: Edit the file in the pull request to update the dependency.
    event: pull_request.synchronize
    link: '{{ repoUrl }}/pull/1'
    actions:
      - type: getFileContents
        action_id: fileContents
        filename: package.json
      - type: gate
        left: '/"debug": "[\^\~\>]?\=?\d+\.\d+\.\d+"/g'
        operator: test
        right: '%actions.fileContents%'
        else:
        - type: respond
          issue: Update the vulnerable dependency
          with: 03_adding-bad-changes.md
      - type: removeBranchProtection
      - type: respond
        with: 03_good-pr.md

  # Step 4
  # Learner merges in the PR
  # Bot creates new issue talking about automating process with dependabot
  # Bot responds with link to new issue. Instrucs learner to install and close issue when done

  - title: Merge your pull request
    description: Merge the pull request you've opened to update the vulnerability dependency.
    event: pull_request.closed
    link: '{{ repoUrl }}/pull/1'
    actions:
      - type: gate
        left: '%payload.pull_request.merged%'
        else:
        - type: octokit
          method: issues.edit
          state: open
          owner: '%payload.repository.owner.login%'
          repo: '%payload.repository.name%'
          number: '%payload.repository.pull_request.number%'
        - type: respond
          with: 04_accidental-close.md
      - type: updateBranchProtection
      - type: createIssue
        title: Add Dependabot to your repository
        body: 04_add-dependabot.md #dependabot issue body response
        action_id: dependabotIssue
      - type: respond
        with: 04_good-merge.md #Link to dependabot issue
        data:
          url: '%actions.dependabotIssue.data.html_url%'

  # Step 5
  # Learner installs dependabot on repository and closes the issue
  # Bot creates new issue about adding a security policy with suggested information about the security policy. Prompts learner to merge when ready

  - title: Enable Dependabot
    description: Install Dependabot on your repository.
    event: issues.closed
    link: '{{ repoUrl }}/issues/5'
    actions:
    - type: createIssue
      title: Add a Security Policy
      body: 05_add-security-policy.md #security policy issue body (add branch name instructions and examples)
      action_id: securityIssue
    - type: respond
      issue: Add Dependabot to your repository
      with: 05_successful-close.md #link to security issue
      data:
        url: '%actions.securityIssue.data.html_url%'

  # Step 6
  # Learner adds a security polcy through the security tab thereby creating a new PR
  # Bot approves the PR
  # Bot prompts user to merge when ready

  - title: Add a SECURITY.md file
    description: Add a SECURITY.md file to your repository.
    event: pull_request.opened
    link: '{{ repoUrl }}/pull/7'
    actions:
      - type: createReview
        event: APPROVE
        body: 06_suggest-merge.md #error response that PR was closed not merged. Reopen PR

  # Step 7

  - title: Merge the SECURITY.md pull request
    description: Merge the pull request.
    event: pull_request.closed
    link: "{{ repoUrl }}/pull/7"
    actions:
      - type: gate
        left: "%payload.pull_request.merged%"
        else:
          - type: respond
            with: 06_accidental-close.md
      - type: createPullRequest
        title: Add wolverine octocat to game
        body: 06_add-wolverine-image.md
        head: add-wolverine-image
        action_id: addWolverine
      - type: respond
        issue: '%actions.addWolverine.data.number%'
        with: 06_remove-sensitive-commit.md
      - type: respond
        with: 06_good-merge.md
        data:
          url: '%actions.addWolverine.data.html_url%'


  # Step 8
  # Learner removes sensitive data in PR
  # Bot responds with information on sensitive data and contacting support for garbage collection and caching
  # Bot prompts learner to approve the PR

  - title: Remove sensitive data in a pull request
    description: Remove sensitive data pushed to a pull request
    event: pull_request.synchronize
    link: '{{ repoUrl }}/pull/8'
    actions:
    - type: octokit
      method: pullRequests.listFiles
      owner: '%payload.repository.owner.login%'
      repo: '%payload.repository.name%'
      number: '%payload.pull_request.number%'
      action_id: prFiles
    - type: gate
      left: '%actions.prFiles.data%'
      operator: '!includes'
      right: 'filename:.env'
      required: false
      else:
      - type: respond
        with: 07_error-file-change.md #success response to remove .env file | Add note about contacting support for garbage collection
    - type: respond
      with: 07_success-file-change.md #failed response to remove .env file

  # Step 9
  # Learner approves PR
  # Bot merges PR and responds with link to new PR to create a .gitignore file

  - title: Approve the pull request
    description: Approve the contributors pull request
    event: pull_request_review.submitted
    link: '{{ repoUrl }}/pull/8'
    actions:
      - type: gate
        left: '%payload.review.state%'
        operator: ===
        right: 'approved'
        else:
        - type: respond
          with: 08_error-approval.md # add response to add an approving review
      - type: mergeBranch
        head: add-wolverine-image
      - type: createPullRequest
        title: Add .gitignore file
        body: 08_add-gitignore.md # body of the .gitignore body
        head: add-gitignore
        action_id: addGitignore
      - type: respond
        issue: Add wolverine octocat to game
        with: 08_go-to-gitignore.md # Bot response to new PR
        data:
          url: '%actions.addGitignore.data.html_url%'

  # Step 10
  # Learner adds .env to the .gitignore file
  # Bot validates file update

  - title: Add a `.gitignore` file
    description: The `.gitignore` file is ready to be edited in an open pull request. Add the `.env` file to the `.gitignore` file.
    event: pull_request.synchronize
    link: '{{ repoUrl }}/pull/8'
    actions:
      - type: getFileContents
        action_id: fileContents
        filename: .gitignore
      - type: gate
        left: '/\.env/m'
        operator: test
        right: '%actions.fileContents%'
        else:
        - type: respond
          with: 09_error-file-change.md
      - type: respond
        with: 09_good-file-change.md
      - type: removeBranchProtection

  # Step 11
  # Learner merges PR
  # Bot creates new issue about sensitive date in the repository's history
  # Bot prompts learner to provide first commit SHA ID that needs to be removed

  - title: Merge the pull request
    description: Merge the second pull request with updates to the `.gitignore` file.
    event: pull_request.closed
    link: '{{ repoUrl }}/pull/9'
    actions:
      - type: gate
        left: '%payload.pull_request.merged%'
        else:
          - type: octokit
            method: issues.edit
            state: open
            owner: '%payload.repository.owner.login%'
            repo: '%payload.repository.name%'
            number: '%payload.repository.pull_request.number%'
          - type: respond
            with: 10_early-close.md
      - type: createIssue
        title: Sensitive data committed to history
        body: 10_committed-sensitive-data.md # sensitive data in history isse body | instruct learner to force push change in a PR and bot will respond there
        action_id: committedData
      - type: respond
        with: 10_nice-merge.md # response to next issue on resolving committed data
        data:
          url: '%actions.committedData.data.html_url%'

  # Step 12
  # Learner comments in issue the commit SHA ID that added the sensitive file
  # Bot validates comment
  # Bot prompts learner to force push changes to remove history reference of these commits

  - title: Find historical reference to a previous .env file
    description: Find historical reference to a previously committed .env file
    event: issue_comment.created
    link: '{{ repoUrl }}/issues/10'
    actions:
      - type: gate
        left: '848cd8'
        operator: test
        right: '%payload.comment.body%'
        else:
          - type: respond
            with: 11_wrong-commit-id.md
      - type: respond
        with: 11_correct-commit-id.md
        action_id: historicalCommit

  # Step 13
  # Learner force pushes change to remove historical references of committed file data (commit to add and commit to remove)
  # Bot validates removal of historical reference of commits with sensitive data (56d6fbbd3bcb476b2829c0dff411e3e0b9b03b69 and 848cd8c2043f6161a4f0043bffee212777281494)
  # Bot responds with congratulations issue

  - title: Remove historical reference to a previous .env file
    description: Remove historical reference to a previously committed .env file
    event: issue_comment.created
    link: '{{ repoUrl }}/issues/10'
    actions:
      - type: gate
        left: '/(848cd8c)|(56d6fbb)/g'
        operator: '!test'
        right: '%payload.comment.body%'
        else:
        - type: respond
          with: 12_try-again-response.md
      - type: octokit
        method: repos.getPages
        owner: '%payload.repository.owner.login%'
        repo: '%payload.repository.name%'
        action_id: pagesUrl
      - type: createIssue
        title: Congratulations!
        body: 12_final-issue.md
        data:
          pagesUrl: '%actions.pagesUrl.data.html_url%'
        action_id: finalIssue
      - type: updateBranchProtection
      - type: respond
        with: 12_correct-references-removed.md # replace with nice job removing .env file response
        data:
          url: '%actions.finalIssue.data.html_url%'

tags: [
  "Security", "Dependency management", "Rebasing", "Auditing", "Dependabot"
]