From 42f2417260fde84e12241a6a54f32272d6a2f41d Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Fri, 6 Dec 2024 14:40:07 +0000 Subject: [PATCH 1/3] Add gosec gh action --- .github/workflows/gosec-scan.yaml | 57 +++++++++++++++++++++++++++++++ .gitignore | 5 ++- default-gosec.mk | 9 ++--- 3 files changed, 66 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/gosec-scan.yaml diff --git a/.github/workflows/gosec-scan.yaml b/.github/workflows/gosec-scan.yaml new file mode 100644 index 00000000..efc322c9 --- /dev/null +++ b/.github/workflows/gosec-scan.yaml @@ -0,0 +1,57 @@ +# Copyright 2024 The Nephio Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: Gosec security scan + +on: + push: + paths-ignore: + - "docs/**" + - "release/**" + - ".prow.yaml" + - "OWNERS" + pull_request: + paths-ignore: + - "docs/**" + - "release/**" + - ".prow.yaml" + - "OWNERS" + +jobs: + tests: + name: Porch gosec scan + runs-on: ubuntu-latest + permissions: + # required for all workflows + security-events: write + env: + GO111MODULE: on + steps: + - name: Checkout Porch + uses: actions/checkout@v4 + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version: '>=1.22.2' + - name: Run Gosec Security Scanner + uses: securego/gosec@master + with: + # we let the report trigger content trigger a failure using the GitHub Security features. + args: '-no-fail -exclude-dir=generated -exclude-dir=test -exclude-generated=true -fmt=sarif -out=results.sarif ./...' + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: results.sarif + token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.gitignore b/.gitignore index 26a28f3c..61b682f5 100644 --- a/.gitignore +++ b/.gitignore @@ -28,4 +28,7 @@ __debug* ### VisualStudioCode Patch ### # Ignore all local history of files -**/.history \ No newline at end of file +**/.history + +# gosec artifacts +*results.html \ No newline at end of file diff --git a/default-gosec.mk b/default-gosec.mk index b0e146f8..70c91dc9 100644 --- a/default-gosec.mk +++ b/default-gosec.mk @@ -1,4 +1,4 @@ -# Copyright 2023 The Nephio Authors. +# Copyright 2023-2024 The Nephio Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -12,7 +12,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -GOSEC_VER ?= 2.19.0 +GOSEC_VER ?= 2.21.4 GIT_ROOT_DIR ?= $(dir $(lastword $(MAKEFILE_LIST))) include $(GIT_ROOT_DIR)/detect-container-runtime.mk @@ -20,7 +20,8 @@ include $(GIT_ROOT_DIR)/detect-container-runtime.mk .PHONY: gosec gosec: ## Inspect the source code for security problems by scanning the Go Abstract Syntax Tree ifeq ($(CONTAINER_RUNNABLE), 0) - $(RUN_CONTAINER_COMMAND) docker.io/securego/gosec:${GOSEC_VER} ./... + $(RUN_CONTAINER_COMMAND) docker.io/securego/gosec:${GOSEC_VER} -fmt=html -out=gosec-results.html \ + -stdout -verbose=text -exclude-dir=generated -exclude-dir=test -exclude-generated ./... else - gosec ./... + gosec -fmt=html -out=gosec-results.html -stdout -verbose=text -exclude-dir=generated -exclude-dir=test -exclude-generated ./... endif From 2cf158cf9bfb1271d9b56fac30aeaebc6d87a3da Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Mon, 9 Dec 2024 18:47:51 +0000 Subject: [PATCH 2/3] Update gosec-scan.yaml Sync gh action gosec version with make file version --- .github/workflows/gosec-scan.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/gosec-scan.yaml b/.github/workflows/gosec-scan.yaml index efc322c9..61cb7570 100644 --- a/.github/workflows/gosec-scan.yaml +++ b/.github/workflows/gosec-scan.yaml @@ -45,7 +45,7 @@ jobs: with: go-version: '>=1.22.2' - name: Run Gosec Security Scanner - uses: securego/gosec@master + uses: securego/gosec@v2.21.4 with: # we let the report trigger content trigger a failure using the GitHub Security features. args: '-no-fail -exclude-dir=generated -exclude-dir=test -exclude-generated=true -fmt=sarif -out=results.sarif ./...' @@ -54,4 +54,4 @@ jobs: with: # Path to SARIF file relative to the root of the repository sarif_file: results.sarif - token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + token: ${{ secrets.GITHUB_TOKEN }} From 53f004a033f04a2ee24efb08869ab1e1cd9a3225 Mon Sep 17 00:00:00 2001 From: Fiachra Corcoran Date: Thu, 12 Dec 2024 13:44:59 +0000 Subject: [PATCH 3/3] Update .gitignore Clean up rebase error --- .gitignore | 1 - 1 file changed, 1 deletion(-) diff --git a/.gitignore b/.gitignore index 603924e8..577f250a 100644 --- a/.gitignore +++ b/.gitignore @@ -32,7 +32,6 @@ __debug* # gosec artifacts *results.html -======= ### Jetbrains IDEs ### .idea/*