.dast-nuclei-cmd-api-server.yaml

name: DAST_Scan_Nuclei

env:
  NODEJS_VERSION: v18.18.2

on:
  push:
    branches: [main, dev]

  pull_request:
    branches: [main, dev]

jobs:
  nuclei-scan:
    runs-on: ubuntu-22.04
    steps:
      - name: Set up NodeJS ${{ env.NODEJS_VERSION }}
        uses: actions/setup-node@v4.0.3
        with:
          node-version: ${{ env.NODEJS_VERSION }}

      - name: Install jq
        run: sudo apt update && sudo apt install -y jq

      - name: Verify jq
        run: jq --version

      - uses: actions/checkout@v4.1.7

      - uses: actions/setup-go@v4.0.0
        with:
          go-version: 1.23

      - run: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v3.3.5

      - run: nuclei --version

      - run: npm run configure

      - name: Create URLs file for Nuclei
        run: |
          echo https://localhost:4000/ > urls.txt
          {
          echo https://localhost:4000/api/v1/api-server/healthcheck
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/node/jws
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/consortium/jws
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/get-prometheus-exporter-metrics
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/run-transaction
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-transaction-receipt-by-txid
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract-go-source
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-prometheus-exporter-metrics
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/deploy-contract-solidity-bytecode
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-balance
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-block
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/run-transaction
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-transaction
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-past-logs
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/invoke-contract
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/sign-transaction
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-prometheus-exporter-metrics
          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-besu-record
          } >> urls.txt

      - run: yarn generate-api-server-config

      - run: jq '.authorizationProtocol = "NONE"' .config.json > .config2.json && mv .config2.json .config.json
      
      # Delete the first and the second items in the array (remove keychain and manual consortium plugins)
      - run: jq 'del(.plugins[0,1])' .config.json > .config2.json && mv .config2.json .config.json

      - name: Install Keychain manual plugin into the API server
        run: jq '.plugins += [{ "packageName":"@hyperledger/cactus-plugin-keychain-memory","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"packageSrc":"/home/runner/work/cactus/cactus/packages/cactus-plugin-keychain-memory/","instanceId":"0daacd05-d1cd-4eab-9332-4ad1aff4b909","keychainId":"d29d728e-eaa0-4e2d-b187-d132242b0d9a"}}]' .config.json > .config2.json && mv .config2.json .config.json

      - name: Install Fabric connector into the API server
        run: jq '.plugins += [{ "packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{ "packageSrc":"/home/runner/work/cactus/cactus/packages/cactus-plugin-ledger-connector-fabric/", "instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json > .config2.json && mv .config2.json .config.json

      - name: Install Besu connector into the API server
        run: jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-besu","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"packageSrc":"/home/runner/work/cactus/cactus/packages/cactus-plugin-ledger-connector-besu/", "rpcApiHttpHost":"http://localhost:8545", "rpcApiWsHost":"ws://localhost:8546", "instanceId":"some-unique-besu-connector-instance-id"}}]' .config.json > .config2.json && mv .config2.json .config.json

      - name: Run Besu all-in-one image
        run: |
          docker run -d -p 0.0.0.0:8545:8545/tcp  -p 0.0.0.0:8546:8546/tcp  -p 0.0.0.0:8888:8888/tcp  -p 0.0.0.0:9001:9001/tcp  -p 0.0.0.0:9545:9545/tcp ghcr.io/hyperledger/cactus-besu-all-in-one:v2.0.0-rc.7
          until curl --fail -X POST --data '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' localhost:8545; do sleep 5;  done

      - name: Print API Server Config File - ./.config.json
        run: cat .config.json

      - name: Print Nuclei Config File - ./.nuclei-config.yaml
        run: cat .nuclei-config.yaml

      - name: Print Nuclei URL List File - ./urls.txt
        run: cat urls.txt

      - name: Start API Server & Run DAST
        uses: BerniWittmann/background-server-action@v1.1.0
        env:
            # Needed because the wait-on syntax otherwise keeps thinking that
            # there is a problem due to our self signed certificates on the
            # test instance of the API server
            NODE_TLS_REJECT_UNAUTHORIZED: 0
        with:
          build: yarn --version
          start: yarn start:api-server
          command: "nuclei -update-templates -list=urls.txt -dast -severity=high,critical -sarif-export ~/nuclei.sarif -output=nuclei.log"
          command-windows: echo "The project build is not supported on the Windows operating system. Please use Linux or macOS"
          wait-on: "https://localhost:4000/api/v1/api-server/healthcheck"
          # wait for 10 minutes for the server to respond
          wait-on-timeout: 120

      - name: GitHub Workflow artifacts
        uses: actions/upload-artifact@v3.0.0
        with:
          name: nuclei.log
          path: nuclei.log