diff --git a/.github/workflows/alert-update-flags.yaml b/.github/workflows/alert-update-flags.yaml index d8ecb8e31aa..2b9c2c41b5f 100644 --- a/.github/workflows/alert-update-flags.yaml +++ b/.github/workflows/alert-update-flags.yaml @@ -10,16 +10,20 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: notification-update-flags: name: Send email with flag changes runs-on: cx-public-ubuntu-x64 - steps: - name: Checkout project uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 2 + persist-credentials: false - name: Execute diff and send email env: AWS_REGION: ${{ secrets.EMAIL_AWS_REGION }} diff --git a/.github/workflows/alert-update-terraform-modules.yaml b/.github/workflows/alert-update-terraform-modules.yaml index ec9ddcc2a67..344844546ed 100644 --- a/.github/workflows/alert-update-terraform-modules.yaml +++ b/.github/workflows/alert-update-terraform-modules.yaml @@ -8,15 +8,20 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: notification-update-flags: name: Send email with terraform modules updates runs-on: cx-public-ubuntu-x64 - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Execute diff and send email env: AWS_REGION: ${{ secrets.EMAIL_AWS_REGION }} @@ -29,6 +34,8 @@ jobs: -u https://registry.terraform.io/v1/modules - name: Create Pull Request uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1 + env: + GIT_SHA: ${{ github.sha }} with: title: "feat(queries): update terraform registry data on commons.json" token: ${{ secrets.KICS_BOT_PAT }} @@ -38,5 +45,5 @@ jobs: body: | **Automated Changes** Updating terraform registry data on commons.json. - Triggered by SHA: _${{ github.sha }}_ + Triggered by SHA: _"${GIT_SHA}"_ labels: terraform diff --git a/.github/workflows/cesar.yaml b/.github/workflows/cesar.yaml index a9930a2873b..95cc85a8dfc 100644 --- a/.github/workflows/cesar.yaml +++ b/.github/workflows/cesar.yaml @@ -9,18 +9,28 @@ env: ENGINE: "kics" REMOVE_HISTORY: "true" +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + id-token: read # default deny-write baseline; the ci-projects job below elevates to write for AWS OIDC + jobs: build: + name: Build KICS binary if: (github.event.label.name == 'cesar' && github.event.pull_request.mergeable == true) runs-on: cx-public-ubuntu-x64 - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: refs/pull/${{ github.event.pull_request.number }}/merge path: kics - - - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + persist-credentials: false + - name: Setup Go + uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 with: go-version-file: kics/go.mod cache-dependency-path: kics/go.sum @@ -37,22 +47,29 @@ jobs: chmod +x ./bin/kics - name: Create Metadata File + env: + PR_NUMBER: ${{ github.event.number }} + PR_TITLE: ${{ github.event.pull_request.title }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + PR_ACTOR: ${{ github.actor }} + PR_HEAD_REF: ${{ github.head_ref }} + PR_BASE_REF: ${{ github.base_ref }} run: | COMMIT_TIMESTAMP=$(git -C "$GITHUB_WORKSPACE/kics" log -1 --format=%ct) METADATA_PATH="$GITHUB_WORKSPACE/pr-metadata.json" CURR_TIMESTAMP=$(date +%s) echo '{ "seq": "'"${CURR_TIMESTAMP}"'", - "tag": "'"${{ github.event.number }}"'", - "comment": "'"${{ github.event.pull_request.title }}"'", - "commit": "'"${{ github.event.pull_request.head.sha }}"'", - "owner": "'"${{ github.actor }}"'", - "branch": "'"${{ github.head_ref }}"'", + "tag": "'"${PR_NUMBER}"'", + "comment": "'"${PR_TITLE}"'", + "commit": "'"${PR_HEAD_SHA}"'", + "owner": "'"${PR_ACTOR}"'", + "branch": "'"${PR_HEAD_REF}"'", "engine": "'"${ENGINE}"'", "platform": "'"${PLATFORM}"'", "version": "'"${ENGINE_VERSION}"'", "forkSeq": "'"${CURR_TIMESTAMP}"'", - "forkBranch": "'"${{ github.base_ref }}"'", + "forkBranch": "'"${PR_BASE_REF}"'", "removeHistory" : "'"${REMOVE_HISTORY}"'" }' > "$METADATA_PATH" @@ -76,8 +93,10 @@ jobs: retention-days: 1 ci-projects: + permissions: + id-token: write # run kics againts the projects needs: build uses: ./.github/workflows/run-projects.yaml with: machines-count: 10 - secrets: inherit + secrets: inherit # zizmor: ignore[secrets-inherit] run-projects.yaml is an internal same-repo reusable workflow, fixed caller set (here + ci-projects.yaml), needs several CES_*/GH_TOKEN secrets for AWS OIDC + private executor-repo checkout diff --git a/.github/workflows/check-apache-license.yaml b/.github/workflows/check-apache-license.yaml index f33fd066f3f..15d20bc7efd 100644 --- a/.github/workflows/check-apache-license.yaml +++ b/.github/workflows/check-apache-license.yaml @@ -1,22 +1,31 @@ name: check-apache-license on: + # zizmor: ignore[dangerous-triggers] needs secrets/write access to label & comment on PRs from forks; + # checkout never overrides ref, so it always checks out the trusted base branch, never the PR head, + # and no PR-supplied content is ever executed as code (only compared/sent as plain data) pull_request_target: types: [opened, synchronize, edited, reopened] branches: - master + permissions: contents: read concurrency: group: check-apache-license-${{ github.event.pull_request.number }} cancel-in-progress: true + jobs: check-license: + name: Check Apache License runs-on: cx-public-ubuntu-x64 timeout-minutes: 1 env: BODY: ${{ github.event.pull_request.body }} USERNAME: ${{ github.event.pull_request.user.login }} + KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }} + REPOSITORY: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number }} steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -31,8 +40,8 @@ jobs: - name: Check for comment tag if: env.CHECK_FAILED != 'true' run: | - comments=$(curl -s -H "Authorization: token ${{ secrets.KICS_BOT_PAT }}" \ - -X GET "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments") + comments=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" \ + -X GET "https://api.github.com/repos/"${REPOSITORY}"/issues/"${PR_NUMBER}"/comments") if echo "$comments" | grep -q "apache_license"; then echo "TAG_EXISTS=true" >> $GITHUB_ENV else @@ -46,7 +55,7 @@ jobs: Deleting comment... comment-tag: apache_license mode: delete - github-token: ${{ secrets.KICS_BOT_PAT }} + github-token: "${KICS_BOT_PAT}" - name: Add comment if no license if: env.CHECK_FAILED == 'true' uses: step-security/actions-comment-pull-request@60cd38988a354b2d22b47612fb02a20e822d6048 # v3.0.2 @@ -55,7 +64,7 @@ jobs: comment-tag: apache_license mode: recreate create-if-not-exists: true - github-token: ${{ secrets.KICS_BOT_PAT }} + github-token: "${KICS_BOT_PAT}" - name: Workflow failed if: env.CHECK_FAILED == 'true' run: exit 1 diff --git a/.github/workflows/check-go-coverage.yaml b/.github/workflows/check-go-coverage.yaml index 24ff3645437..ea9a6226819 100644 --- a/.github/workflows/check-go-coverage.yaml +++ b/.github/workflows/check-go-coverage.yaml @@ -7,6 +7,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: coverage: name: generate-coverage @@ -19,7 +23,8 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Set up Go + persist-credentials: false + - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version-file: go.mod @@ -31,7 +36,9 @@ jobs: echo "Total number of tests :: ${TOTAL_TESTS}" echo "::set-output name=total_tests::${TOTAL_TESTS}" - name: Checks if Go coverage is at least 74% - if: steps.testcov.outputs.coverage < 74 + env: + GO_COVERAGE: ${{ steps.testcov.outputs.coverage }}% + if: GO_COVERAGE < 74 run: | - echo "Go coverage is lower than 74%: ${{ steps.testcov.outputs.coverage }}%" + echo "Go coverage is lower than 74%: "${GO_COVERAGE }"%" exit 1 diff --git a/.github/workflows/ci-projects.yaml b/.github/workflows/ci-projects.yaml index 5d7cba450b3..e06637769bc 100644 --- a/.github/workflows/ci-projects.yaml +++ b/.github/workflows/ci-projects.yaml @@ -10,18 +10,30 @@ env: PLATFORM: "LINUX_X64" ENGINE: "kics" +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: build: + name: Build Kics to run againts projects if: github.event.pull_request.merged == true runs-on: cx-public-ubuntu-x64 - + permissions: + contents: read # for actions/checkout to fetch code steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.event.pull_request.merge_commit_sha }} path: kics + persist-credentials: false - - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + - name: Setup Go + uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 with: go-version-file: kics/go.mod cache-dependency-path: kics/go.sum @@ -38,16 +50,22 @@ jobs: chmod +x ./bin/kics - name: Create Metadata File + env: + PR_NUMBER: ${{ github.event.number }} + PR_TITLE: ${{ github.event.pull_request.title }} + PR_SHA: ${{ github.sha }} + PR_ACTOR: ${{ github.actor }} + PR_BASE_REF: ${{ github.base_ref }} run: | COMMIT_TIMESTAMP=$(git -C "$GITHUB_WORKSPACE/kics" log -1 --format=%ct) METADATA_PATH="$GITHUB_WORKSPACE/pr-metadata.json" echo '{ "seq": "'"${COMMIT_TIMESTAMP}"'", - "tag": "'"${{ github.event.number }}"'", - "comment": "'"${{ github.event.pull_request.title }}"'", - "commit": "'"${{ github.sha }}"'", - "owner": "'"${{ github.actor }}"'", - "branch": "'"${{ github.base_ref }}"'", + "tag": "'"${PR_NUMBER}"'", + "comment": "'"${PR_TITLE}"'", + "commit": "'"${PR_SHA}"'", + "owner": "'"${PR_ACTOR}"'", + "branch": "'"${PR_BASE_REF}"'", "engine": "'"${ENGINE}"'", "platform": "'"${PLATFORM}"'", "version": "'"${ENGINE_VERSION}"'" @@ -74,7 +92,9 @@ jobs: ci-projects: needs: build + permissions: + id-token: write # required to pass id-token permission through to run-projects.yaml for AWS OIDC federation uses: ./.github/workflows/run-projects.yaml with: machines-count: 10 - secrets: inherit + secrets: inherit # zizmor: ignore[secrets-inherit] run-projects.yaml is an internal same-repo reusable workflow, fixed caller set (here + cesar.yaml), needs several CES_*/GH_TOKEN secrets for AWS OIDC + private executor-repo checkout diff --git a/.github/workflows/go-ci-coverage.yaml b/.github/workflows/go-ci-coverage.yaml index 02dbe9edeb4..a3d7c6a58fb 100644 --- a/.github/workflows/go-ci-coverage.yaml +++ b/.github/workflows/go-ci-coverage.yaml @@ -8,6 +8,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: coverage: name: generate-coverage @@ -20,7 +24,8 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Set up Go + persist-credentials: false + - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version-file: go.mod @@ -32,18 +37,24 @@ jobs: echo "Total Tests :: ${TOTAL_TESTS}" echo "::set-output name=total_tests::${TOTAL_TESTS}" - name: Generate badge + env: + GO_COVERAGE: ${{ steps.testcov.outputs.coverage }} + GO_COLOR: ${{ steps.testcov.outputs.color }} run: | curl -L \ - https://img.shields.io/badge/Go%20Coverage-${{ steps.testcov.outputs.coverage }}%25-${{ steps.testcov.outputs.color }}.svg > coverage.svg + https://img.shields.io/badge/Go%20Coverage-"${GO_COVERAGE}"%25-"${GO_COLOR}".svg > coverage.svg cat coverage.svg - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - name: Upload coverage svg Artifact + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ runner.os }}-badge-latest path: coverage.svg - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - name: Upload coverage html Artifact + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ runner.os }}-coverage-latest path: coverage.html + publish: permissions: contents: write # for Git to git push @@ -55,6 +66,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: gh-pages + persist-credentials: true - name: Configure git commit author run: | git config --global user.name "KICSBot" diff --git a/.github/workflows/go-ci-integration.yml b/.github/workflows/go-ci-integration.yml index 59ca1cb54bc..5f8a4ffe690 100644 --- a/.github/workflows/go-ci-integration.yml +++ b/.github/workflows/go-ci-integration.yml @@ -7,6 +7,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: integration-tests: permissions: @@ -14,6 +18,8 @@ jobs: contents: read # for docker/build-push-action to read repo content name: integration-tests runs-on: cx-public-ubuntu-x64 + env: + PR_SHA: ${{ github.sha }} steps: - id: skip_check uses: step-security/skip-duplicate-actions@4eef6ae57f2ca5ea100e5c1da2ead9138483f53c # v5.3.4 @@ -24,7 +30,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Set up Docker Buildx + - name: Setup Docker Buildx id: buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Cache Docker layers @@ -45,18 +51,20 @@ jobs: file: ./Dockerfile builder: ${{ steps.buildx.outputs.name }} push: false - tags: kics:${{ github.sha }} + tags: kics:${{ env.PR_SHA }} build-args: | VERSION=${GITHUB_SHA_SHORT} COMMIT=${GITHUB_SHA} cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache - name: Image digest - run: echo ${{ steps.docker_build.outputs.digest }} + env: + OUTPUT_DIGEST: ${{ steps.docker_build.outputs.digest }} + run: echo "${OUTPUT_DIGEST}" - name: Run docker image and generate results.json run: | docker run --user $(id -u):$(id -g) -v ${PWD}/assets/queries:/path \ - kics:${{ github.sha }} scan \ + kics:"${PR_SHA}" scan \ --silent \ --ignore-on-exit "results" \ --log-level DEBUG \ diff --git a/.github/workflows/go-ci-metrics.yaml b/.github/workflows/go-ci-metrics.yaml index 0b04acadfd2..d45bb347b9f 100644 --- a/.github/workflows/go-ci-metrics.yaml +++ b/.github/workflows/go-ci-metrics.yaml @@ -6,9 +6,14 @@ on: branches: [master] paths: - "assets/queries/**/metadata.json" + permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: metrics: name: test-metrics @@ -16,7 +21,10 @@ jobs: steps: - name: Checkout Source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 + with: + persist-credentials: false + - name: Setup python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" - name: Run test metrics script @@ -25,14 +33,17 @@ jobs: pip3 install -r .github/scripts/metrics/requirements.txt python3 .github/scripts/metrics/get_metrics.py - name: Generate badge + env: + TOTAL_QUERIES: ${{ steps.metrics.outputs.total_queries }} run: | curl -L \ - https://img.shields.io/badge/Queries-${{ steps.metrics.outputs.total_queries }}-blue.svg > queries.svg + "https://img.shields.io/badge/Queries-${TOTAL_QUERIES}-blue.svg" > queries.svg cat queries.svg - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: ${{ runner.os }}-queries-badge-latest path: queries.svg + publish: permissions: contents: write # for Git to git push @@ -44,6 +55,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: gh-pages + persist-credentials: true - name: Configure git commit author run: | git config --global user.name "KICSBot" diff --git a/.github/workflows/go-ci.yml b/.github/workflows/go-ci.yml index 68df046f8c8..1c918c9a77b 100644 --- a/.github/workflows/go-ci.yml +++ b/.github/workflows/go-ci.yml @@ -4,13 +4,26 @@ on: pull_request: branches: [master] +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: lint: - name: lint + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: read # for step-security/golangci-lint-action to post PR review comments + name: lint (golangci-lint) runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up Go + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Setup Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod @@ -18,25 +31,31 @@ jobs: - name: golangci-lint uses: step-security/golangci-lint-action@1797facf9ea427614d729a4e9cab0fae1a7852d9 # v9.2.0 with: - version: v2.9.0 + version: v2.11.3 args: -c .golangci.yml --timeout 20m + go-generate: name: go-generate runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code steps: - name: Check out code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false fetch-depth: 0 - - name: Set up Go + - name: Setup Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod - name: Generate mocks and marshall/unmarshall code run: make generate + unit-tests: name: unit-tests + permissions: + contents: read # for actions/checkout and actions/cache strategy: matrix: go-version: [1.26.x] @@ -49,7 +68,7 @@ jobs: with: use-policy-store: true api-key: ${{ secrets.STEP_SECURITY_API_KEY }} - - name: Set up Go + - name: Setup Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: ${{ matrix.go-version }} @@ -86,19 +105,36 @@ jobs: go test -tags dev -mod=vendor -v -timeout 2100s $(go list -tags dev ./... | grep -v e2e) -count=1 -coverprofile=cover.out | tee unit-test.log result_code=${PIPESTATUS[0]} exit $result_code + - name: Exclude Go temp dir from Windows Defender + if: matrix.os == 'cx-public-windows-2022-x64' + shell: powershell + run: Add-MpPreference -ExclusionPath $env:TEMP - name: Test and Generate Report Windows Dev if: matrix.os == 'cx-public-windows-2022-x64' + shell: powershell run: | - go test -mod=vendor -tags dev -v -timeout 2100s $(go list -tags dev ./... | grep -v e2e) -count=1 -coverprofile=cover.out | tee unit-test.log + go test -mod=vendor -tags dev -v -timeout 2100s $(go list -tags dev ./... | grep -v e2e) -count=1 -coverprofile=cover.out | Tee-Object unit-test.log + $exitCode = $LASTEXITCODE + if ($exitCode -ne 0) { + $realFailure = Select-String -Path unit-test.log -Pattern '^(--- FAIL|FAIL\s|panic:)' -Quiet + if ($realFailure) { + exit $exitCode + } + Write-Warning "go test exited $exitCode with no FAIL/panic in output - treating as the known Windows 'go: unlinkat ...: Access is denied' cleanup flake." + exit 0 + } - name: Archive test logs if: always() uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: unit-test-${{ matrix.os }}-${{ github.event.pull_request.head.sha }}.log path: unit-test.log + validate-search-line: name: validate-search-line runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code steps: - name: Check out code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -114,10 +150,13 @@ jobs: queries: - 'assets/queries/**/query.rego' - name: Debug filter outputs + env: + QUERIES_FILTER: ${{ steps.filter.outputs.queries }} + QUERIES_FILES: ${{ steps.filter.outputs.queries_files }} run: | - echo "queries changed: ${{ steps.filter.outputs.queries }}" - echo "changed files: ${{ steps.filter.outputs.queries_files }}" - - name: Set up Python + echo "queries changed: ${QUERIES_FILTER}" + echo "changed files: ${QUERIES_FILES}" + - name: Setup Python id: setup-python if: steps.filter.outputs.queries == 'true' uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 @@ -126,7 +165,6 @@ jobs: - name: Validate searchLine in modified queries if: steps.setup-python.outcome == 'success' env: - CHANGED_QUERIES: ${{ steps.filter.outputs.queries_files }} KICS_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} KICS_PR_NUMBER: ${{ github.event.number }} working-directory: .github/scripts/validate-search-line/ @@ -135,11 +173,16 @@ jobs: security-scan: name: security-scan runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload scan results env: GO111MODULE: on steps: - name: Checkout Source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run Gosec Security Scanner uses: securego/gosec@d2d3ae66bd8d340b78b5142b6fe610691783c2fe # v2.22.5 with: diff --git a/.github/workflows/go-e2e-debian.yaml b/.github/workflows/go-e2e-debian.yaml index 55669c8c914..5061456e0ba 100644 --- a/.github/workflows/go-e2e-debian.yaml +++ b/.github/workflows/go-e2e-debian.yaml @@ -7,12 +7,17 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + + jobs: e2e-tests: + name: e2e-tests-${{ matrix.config.tag_suffix }} permissions: actions: write # for styfle/cancel-workflow-action to cancel/stop running workflows contents: read # for docker/build-push-action to read repo content - name: e2e-tests-${{ matrix.config.tag_suffix }} strategy: fail-fast: false matrix: @@ -36,7 +41,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Set up Go + - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version: ${{ matrix.go-version }} @@ -44,10 +49,17 @@ jobs: run: go env - name: Get Modules run: go mod vendor - - name: Set up Node v14 + - name: Setup Node v14 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0 with: node-version: "20" + registry-url: https://npm.echohq.com/ + - name: Authenticate with npm registry + env: + ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }} + run: | + npm config set //npm.echohq.com/:_authToken "${ECHO_LIBRARIES_ACCESS_KEY}" + npm config set //packages.echohq.com/:_authToken "${ECHO_LIBRARIES_ACCESS_KEY}" - name: Lint lockfile run: npx --yes lockfile-lint --path package-lock.json --type npm --allowed-hosts npm working-directory: .github/scripts/server-mock @@ -57,7 +69,7 @@ jobs: - name: Start mock server run: (npm run start&) working-directory: .github/scripts/server-mock - - name: Set up Docker Buildx + - name: Setup Docker Buildx id: buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Cache Docker layers @@ -91,7 +103,9 @@ jobs: cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache - name: Image digest - run: echo ${{ steps.docker_build.outputs.digest }} + env: + DIGEST: ${{ steps.docker_build.outputs.digest }} + run: echo "${DIGEST}" - name: Display PWD / Files run: | pwd diff --git a/.github/workflows/go-e2e.yaml b/.github/workflows/go-e2e.yaml index da060b08717..70e37cb01df 100644 --- a/.github/workflows/go-e2e.yaml +++ b/.github/workflows/go-e2e.yaml @@ -7,6 +7,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: e2e-tests: permissions: @@ -52,7 +56,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Set up Go + - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version: ${{ matrix.go-version }} @@ -60,10 +64,17 @@ jobs: run: go env - name: Get Modules run: go mod vendor - - name: Set up Node v14 + - name: Setup Node v14 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0 with: node-version: "20" + registry-url: https://npm.echohq.com/ + - name: Authenticate with npm registry + env: + ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }} + run: | + npm config set //npm.echohq.com/:_authToken "${ECHO_LIBRARIES_ACCESS_KEY}" + npm config set //packages.echohq.com/:_authToken "${ECHO_LIBRARIES_ACCESS_KEY}" - name: Lint lockfile run: npx --yes lockfile-lint --path package-lock.json --type npm --allowed-hosts npm working-directory: .github/scripts/server-mock @@ -73,7 +84,7 @@ jobs: - name: Start mock server run: (npm run start&) working-directory: .github/scripts/server-mock - - name: Set up Docker Buildx + - name: Setup Docker Buildx id: buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Cache Docker layers @@ -102,7 +113,9 @@ jobs: cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache - name: Image digest - run: echo ${{ steps.docker_build.outputs.digest }} + env: + DIGEST: ${{ steps.docker_build.outputs.digest }} + run: echo "${DIGEST}" - name: Display PWD / Files run: | pwd diff --git a/.github/workflows/go-generate-antlr-parser.yaml b/.github/workflows/go-generate-antlr-parser.yaml index 33b730adb48..c78025761b9 100644 --- a/.github/workflows/go-generate-antlr-parser.yaml +++ b/.github/workflows/go-generate-antlr-parser.yaml @@ -6,9 +6,14 @@ on: branches: [master] paths: - "pkg/parser/jsonfilter/JSONFilter.g4" + permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: metrics: name: generate-antlr-parser @@ -16,7 +21,9 @@ jobs: steps: - name: Checkout Source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up Docker Buildx + with: + persist-credentials: false + - name: Setup Docker Buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Build ANTLR image uses: step-security/docker-build-push-action@846549baaf047e867d038826129a64d81df0f704 # v7.1.0 diff --git a/.github/workflows/go-test-race.yml b/.github/workflows/go-test-race.yml index 475c892145f..173002ae5e8 100644 --- a/.github/workflows/go-test-race.yml +++ b/.github/workflows/go-test-race.yml @@ -4,6 +4,10 @@ on: pull_request: branches: [master] +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + permissions: contents: read @@ -16,7 +20,8 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - name: Set up Go + persist-credentials: false + - name: Setup Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version-file: go.mod diff --git a/.github/workflows/kics-gh-action.yaml b/.github/workflows/kics-gh-action.yaml index f859a5071c3..c5fe46c6133 100644 --- a/.github/workflows/kics-gh-action.yaml +++ b/.github/workflows/kics-gh-action.yaml @@ -5,11 +5,25 @@ on: branches: [master] workflow_dispatch: +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: kics-scan: + name: Run Kics scan through github action runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: write # for checkmarx/kics-github-action's enable_comments to post scan results on the PR steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run KICS Scan uses: checkmarx/kics-github-action@4063ea7186bec9fed1bf055e095a4658693f9998 # v2.1.20 with: @@ -21,7 +35,8 @@ jobs: output_formats: json,html type: dockerfile exclude_queries: 67fd0c4a-68cf-46d7-8c41-bc9fba7e40ae # Ignore Last User Is 'root' - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - name: Upload Results File + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: results path: ./results diff --git a/.github/workflows/mkdocs.yml b/.github/workflows/mkdocs.yml index 19e575a388a..5cf8044b5b4 100644 --- a/.github/workflows/mkdocs.yml +++ b/.github/workflows/mkdocs.yml @@ -7,13 +7,25 @@ on: paths: - "docs/**" - "mkdocs.yml" + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: deploy: + name: Deploy documentation pages runs-on: cx-public-ubuntu-x64 + permissions: + contents: write # for git push to gh-pages steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2 if: always() with: diff --git a/.github/workflows/prepare-release.yaml b/.github/workflows/prepare-release.yaml index 0138816aa73..47e743936bb 100644 --- a/.github/workflows/prepare-release.yaml +++ b/.github/workflows/prepare-release.yaml @@ -8,38 +8,52 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: prepare-release: name: prepare for next release runs-on: cx-public-ubuntu-x64 + permissions: + contents: write # for actions/checkout to fetch code and create-pull-request to push a branch + pull-requests: write # for create-pull-request to open the PR + env: + GIT_VERSION: ${{ github.event.inputs.version }} + PR_SHA: ${{ github.sha }} steps: - name: Checkout project uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Get current date id: cdate run: echo "::set-output name=date::$(date +'%Y.%m.%d')" - name: Print variables + env: + CURRENT_DATE: ${{ steps.cdate.outputs.date }} run: | - echo "Version :: ${{ github.event.inputs.version }}" - echo "Date :: ${{ steps.cdate.outputs.date }}" + echo "Version :: ${GIT_VERSION}" + echo "Date :: ${CURRENT_DATE}" - name: Replace lines + env: + CURRENT_DATE: ${{ steps.cdate.outputs.date }} run: | - sed -E -i "s/

Version \d+(\.\d+)*<\/h4>/

Version ${{ github.event.inputs.version }}<\/h4>/" docs/index.md - sed -E -i "s/()[0-9]{4}\.[0-9]{2}\.[0-9]{2}

/\1${{ steps.cdate.outputs.date }}

/" docs/index.md - sed -E -i "s/()/\1v${{ github.event.inputs.version }}\2${{ github.event.inputs.version }}\3/g" docs/index.md + sed -E -i "s/

Version \d+(\.\d+)*<\/h4>/

Version ${GIT_VERSION}<\/h4>/" docs/index.md + sed -E -i "s/()[0-9]{4}\.[0-9]{2}\.[0-9]{2}

/\1${CURRENT_DATE}

/" docs/index.md + sed -E -i "s/()/\1v${GIT_VERSION}\2${GIT_VERSION}\3/g" docs/index.md - name: Create pull request uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1 with: - title: "docs(kicsbot): preparing for release ${{ github.event.inputs.version }}" - token: ${{ secrets.KICS_BOT_PAT }} - commit-message: "docs(kicsbot): preparing for release ${{ github.event.inputs.version }}" + title: "docs: preparing for release ${{ env.GIT_VERSION }}" + commit-message: "docs: preparing for release ${{ env.GIT_VERSION }}" delete-branch: true - branch: feature/kicsbot-update-docs-index + branch: feature/update-docs-index base: master body: | **Automated Changes** Updating documentation index page. - Triggered by SHA: _${{ github.sha }}_ + Triggered by SHA: _${{ env.PR_SHA }}_ labels: documentation diff --git a/.github/workflows/release-commits.yaml b/.github/workflows/release-commits.yaml index 28a8928de31..f0852358e86 100644 --- a/.github/workflows/release-commits.yaml +++ b/.github/workflows/release-commits.yaml @@ -8,6 +8,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: release-commits: name: get-release-commits @@ -15,10 +19,13 @@ jobs: steps: - name: Checkout Source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up Go + with: + persist-credentials: false + - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version-file: go.mod + cache: false - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" diff --git a/.github/workflows/release-dkr-image.yml b/.github/workflows/release-dkr-image.yml index 81b44d0cb51..41a8db6fac5 100644 --- a/.github/workflows/release-dkr-image.yml +++ b/.github/workflows/release-dkr-image.yml @@ -5,11 +5,21 @@ on: types: [created, published] workflow_dispatch: +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # default deny-write baseline; the push_to_registry job elevates as needed + jobs: push_to_registry: name: Push Docker image to Docker Hub runs-on: cx-public-ubuntu-x64 if: "!github.event.release.prerelease" + permissions: + contents: read + id-token: write # required to request the GitHub OIDC token exchanged with Docker Hub's OIDC login env: DOCKER_CLI_EXPERIMENTAL: "enabled" steps: @@ -17,6 +27,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Get Release version id: get-version run: | @@ -24,7 +35,7 @@ jobs: - uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2 if: always() with: - github-token: ${{ secrets.KICS_BOT_PAT }} + github-token: ${{ secrets.GITHUB_TOKEN }} webhook-uri: ${{ secrets.MSTEAMS_WEBHOOK_URL }} card-layout-start: cozy card-layout-exit: complete @@ -35,18 +46,19 @@ jobs: value: https://github.com/Checkmarx/kics/actions/runs/${{ github.run_id }} - name: View HEAD Commit value: https://github.com/Checkmarx/kics/commit/${{ github.sha }} - - name: Set up QEMU + - name: Setup QEMU uses: step-security/setup-qemu-action@109c6ed9f089be1a250c75fd6a534e30df44e030 # v4.0.0 with: image: tonistiigi/binfmt:latest platforms: linux/amd64,linux/arm64 - - name: Set up Docker Buildx + - name: Setup Docker Buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Login to DockerHub - uses: step-security/docker-login-action@870af644803bf9f204aed474adbad2958fec048b # v4.1.0 + uses: step-security/docker-login-action@bd6978fd4ef9a5f78130095b298b8a721afcb0d8 # v4.5.1 with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: checkmarx + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ secrets.DOCKERHUB_OIDC_CONNECTIONID }} - name: Get current date run: echo "CREATED_AT=$(date --rfc-3339=seconds)" >> $GITHUB_ENV - name: Docker meta diff --git a/.github/workflows/release-docker-github-actions.yaml b/.github/workflows/release-docker-github-actions.yaml index 86f0511bc38..6be57294689 100644 --- a/.github/workflows/release-docker-github-actions.yaml +++ b/.github/workflows/release-docker-github-actions.yaml @@ -10,31 +10,43 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: push_to_registry: name: Push Docker GitHub Actions image to Docker Hub runs-on: cx-public-ubuntu-x64 + env: + GIT_VERSION: ${{ github.event.inputs.version }} + PR_SHA: ${{ github.sha }} + KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }} + DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} + DOCKER_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} steps: - name: Check out the repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Check out the tag uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: - ref: ${{ github.event.inputs.version }} - - name: Set up QEMU + ref: ${{ GIT_VERSION }} + persist-credentials: false + - name: Setup QEMU uses: step-security/setup-qemu-action@109c6ed9f089be1a250c75fd6a534e30df44e030 # v4.0.0 with: image: tonistiigi/binfmt:latest platforms: linux/amd64,linux/arm64 - - name: Set up Docker Buildx + - name: Setup Docker Buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Login to DockerHub uses: step-security/docker-login-action@870af644803bf9f204aed474adbad2958fec048b # v4.1.0 with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: ${{ DOCKER_USERNAME }} + password: ${{ DOCKERHUB_TOKEN }} - name: Get current date run: echo "CREATED_AT=$(date --rfc-3339=seconds)" >> $GITHUB_ENV - name: Docker meta @@ -44,7 +56,7 @@ jobs: images: "checkmarx/kics" labels: | org.opencontainers.image.title=KICS - org.opencontainers.image.version=${{ github.event.inputs.version }} + org.opencontainers.image.version=${{ GIT_VERSION }} org.opencontainers.image.vendor=Checkmarx org.opencontainers.image.authors=KICS org.opencontainers.image.description=Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code with KICS by Checkmarx. @@ -52,7 +64,7 @@ jobs: org.opencontainers.image.url=https://github.com/Checkmarx/kics org.opencontainers.image.source=https://github.com/Checkmarx/kics org.opencontainers.image.licenses=Apache-2.0 - org.opencontainers.image.revision=${{ github.sha }} + org.opencontainers.image.revision=${{ PR_SHA }} org.opencontainers.image.created=${{ env.CREATED_AT }} - name: Push Github Action Image to Docker Hub uses: step-security/docker-build-push-action@846549baaf047e867d038826129a64d81df0f704 # v7.1.0 @@ -63,8 +75,8 @@ jobs: platforms: linux/amd64,linux/arm64 tags: checkmarx/kics:gh-action-kics2.0 build-args: | - VERSION=${{ github.event.inputs.version }} - COMMIT=${{ github.sha }} + VERSION=${{ GIT_VERSION }} + COMMIT=${{ PR_SHA }} SENTRY_DSN=${{ secrets.SENTRY_DSN }} DESCRIPTIONS_URL=${{ secrets.DESCRIPTIONS_URL }} labels: ${{ steps.meta.outputs.labels }} @@ -72,16 +84,17 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Create Pull Request uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1 with: title: "docs(kicsbot): update images digest" - token: ${{ secrets.KICS_BOT_PAT }} + token: ${{ KICS_BOT_PAT }} commit-message: "docs(kicsbot): update github-action image digest" delete-branch: true branch: feature/kicsbot-update-gh-actions-digest body: | **Automated Changes** Updating docker github-action image digest - Triggered by SHA: _${{ github.sha }}_ + Triggered by SHA: _${{ PR_SHA }}_ labels: documentation diff --git a/.github/workflows/release-extract-info.yaml b/.github/workflows/release-extract-info.yaml index 2c0ecf59fb4..83374c6fafe 100644 --- a/.github/workflows/release-extract-info.yaml +++ b/.github/workflows/release-extract-info.yaml @@ -1,16 +1,30 @@ name: release-extract-info + on: workflow_dispatch: release: type: [published] + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: statistics: name: extract-info runs-on: cx-public-ubuntu-x64 + permissions: + contents: write # for step-security/upload-release-action to attach the file to the release steps: - name: Checkout Source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 + with: + persist-credentials: false + - name: Setup Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" - name: Run test statistics script @@ -20,10 +34,12 @@ jobs: python3 .github/scripts/extract-kics-info/extract-info.py - name: Upload binaries to release uses: step-security/upload-release-action@ecbc6042326f3a6f5a8c1c1202c4fa1b244db249 # v2.11.4 + env: + GIT_REF: ${{ github.ref }} with: repo_token: ${{ secrets.GITHUB_TOKEN }} file: .github/scripts/extract-kics-info/extracted-info.zip - tag: ${{ github.ref }} + tag: ${{ GIT_REF }} overwrite: true file_glob: true - name: Clean generated files diff --git a/.github/workflows/release-kics-cxone.yaml b/.github/workflows/release-kics-cxone.yaml deleted file mode 100644 index 1234a803a5c..00000000000 --- a/.github/workflows/release-kics-cxone.yaml +++ /dev/null @@ -1,50 +0,0 @@ -name: release-kics-cxone -on: - release: - types: - - published -permissions: - contents: read - -jobs: - create-branch: - permissions: - contents: write # for Git to git push - runs-on: cx-public-ubuntu-x64 - steps: - - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Set up Git credentials - run: | - git config --global user.name "KICSBot" - git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" - git config --global url."https://${{ secrets.CHECKMARXDEV_GIT_TOKEN }}@github.com".insteadOf "https://github.com" - - - name: Clone internal repository - run: | - cd .. - git clone https://github.com/CheckmarxDev/${{ secrets.CHECKMARXDEV_KICS_RELEASER }}.git - - - name: Create new branch for release ${{ github.event.release.name }} - run: | - cd ../${{ secrets.CHECKMARXDEV_KICS_RELEASER }} - git checkout --orphan ${{ github.event.release.name }} - find . -mindepth 1 \( -not -path './.*' -not -name 'README.md' -o -name '.gitignore' \) -delete - - - name: Copy queries to new branch - run: | - mkdir -p ../${{ secrets.CHECKMARXDEV_KICS_RELEASER }}/kics-queries - rsync -av --exclude='*/test/*' --exclude='common/*' ./assets/queries/ ../${{ secrets.CHECKMARXDEV_KICS_RELEASER }}/kics-queries/ - - - name: Modify circleci configuration - run: | - sed -i 's/BRANCH_NAME_TEMPLATE_TO_REPLACE/${{ github.event.release.name }}/g' ../${{ secrets.CHECKMARXDEV_KICS_RELEASER }}/.circleci/config.yml - sed -i 's/BRANCH_NAME_TEMPLATE_TO_REPLACE/${{ github.event.release.name }}/g' ../${{ secrets.CHECKMARXDEV_KICS_RELEASER }}/.github/workflows/*.yaml - - - name: Push branch - run: | - cd ../${{ secrets.CHECKMARXDEV_KICS_RELEASER }} - git add . - git commit -m "AUTO: Add queries from release ${{ github.event.release.name }} to ${{ secrets.CHECKMARXDEV_KICS_RELEASER }}" - git push origin ${{ github.event.release.name }} diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml index d59d269c311..22cc02abced 100644 --- a/.github/workflows/release-nightly.yml +++ b/.github/workflows/release-nightly.yml @@ -5,9 +5,19 @@ on: - cron: "0 2 * * *" workflow_dispatch: +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # default deny-write baseline; jobs below elevate as needed + jobs: pre_release_job: + name: Pre Release Job runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code outputs: changes: ${{ steps.lasttag.outputs.newchanges }} sha8: ${{ steps.shorthash.outputs.sha8 }} @@ -16,22 +26,29 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Check if there are new commits since last nightly id: lasttag run: echo "::set-output name=newchanges::$(bash ./.github/scripts/is-changed-since-last-nightly.sh)" - name: Set short hash id: shorthash run: echo "::set-output name=sha8::$(echo ${GITHUB_SHA} | cut -c1-8)" + goreleaser: + name: Go Releaser needs: pre_release_job if: ${{ needs.pre_release_job.outputs.changes == 'yes' }} runs-on: cx-public-ubuntu-x64 + permissions: + contents: write # to create/delete the nightly release and upload its assets steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2 + persist-credentials: false + - name: Teams Notification channel + uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2 if: always() with: github-token: ${{ secrets.KICS_BOT_PAT }} @@ -48,7 +65,7 @@ jobs: value: https://github.com/Checkmarx/kics/actions/runs/${{ github.run_id }}" - name: View HEAD Commit value: https://github.com/Checkmarx/kics/commit/${{ github.sha }} - - name: Set up Go + - name: Setup Go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: 1.26.x @@ -68,67 +85,35 @@ jobs: tag_name: nightly # tag name to delete env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Create Release - id: create_release - uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - tag_name: nightly - release_name: nightly-${{ needs.pre_release_job.outputs.sha8 }} - draft: false - prerelease: true - name: Display assets run: | ls -l /home/runner/work/kics/kics/dist - - name: Upload Release Asset Linux - id: upload-release-asset-linux - uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps - asset_path: /home/runner/work/kics/kics/dist/kics_nightly_linux_x64.tar.gz - asset_name: kics_nightly-release_linux_amd64.tar.gz - asset_content_type: application/gzip - - name: Upload Release Asset Darwin - id: upload-release-asset-darwin - uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 + - name: Create Release and Upload Assets env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps - asset_path: /home/runner/work/kics/kics/dist/kics_nightly_darwin_x64.tar.gz - asset_name: kics_nightly-release_darwin_amd64.tar.gz - asset_content_type: application/gzip - - name: Upload Release Asset Windows - id: upload-release-asset-windows - uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps - asset_path: /home/runner/work/kics/kics/dist/kics_nightly_windows_x64.zip - asset_name: kics_nightly-release_windows_amd64.zip - asset_content_type: application/zip - - name: Upload Release Asset Checksum - id: upload-release-asset-checksums - uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - upload_url: ${{ steps.create_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps - asset_path: /home/runner/work/kics/kics/dist/kics_nightly_checksums.txt - asset_name: kics_nightly-release_checksums.txt - asset_content_type: text/plain + SHA8: ${{ needs.pre_release_job.outputs.sha8 }} + run: | + gh release create nightly \ + --title "nightly-${SHA8}" \ + --prerelease \ + --notes "" \ + /home/runner/work/kics/kics/dist/kics_nightly_linux_x64.tar.gz#kics_nightly-release_linux_amd64.tar.gz \ + /home/runner/work/kics/kics/dist/kics_nightly_darwin_x64.tar.gz#kics_nightly-release_darwin_amd64.tar.gz \ + /home/runner/work/kics/kics/dist/kics_nightly_windows_x64.zip#kics_nightly-release_windows_amd64.zip \ + /home/runner/work/kics/kics/dist/kics_nightly_checksums.txt#kics_nightly-release_checksums.txt push_to_registry: name: Push Docker image to Docker Hub needs: pre_release_job if: ${{ needs.pre_release_job.outputs.changes == 'yes' }} runs-on: cx-public-ubuntu-x64 + permissions: + contents: write # for create-pull-request to push a branch + pull-requests: write # for create-pull-request to open the PR steps: - name: Check out the repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - uses: toko-bifrost/ms-teams-deploy-card@dcc94e4ce4088b1e6b6de5c9a3cda4ddcbe97d2e # 3.1.2 if: always() with: @@ -146,12 +131,12 @@ jobs: value: https://github.com/Checkmarx/kics/actions/runs/${{ github.run_id }}" - name: View HEAD Commit value: https://github.com/Checkmarx/kics/commit/${{ github.sha }} - - name: Set up QEMU + - name: Setup QEMU uses: step-security/setup-qemu-action@109c6ed9f089be1a250c75fd6a534e30df44e030 # v4.0.0 with: image: tonistiigi/binfmt:latest platforms: linux/amd64,linux/arm64 - - name: Set up Docker Buildx + - name: Setup Docker Buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Login to DockerHub uses: step-security/docker-login-action@870af644803bf9f204aed474adbad2958fec048b # v4.1.0 diff --git a/.github/workflows/run-projects.yaml b/.github/workflows/run-projects.yaml index ec87141817c..678b3f52094 100644 --- a/.github/workflows/run-projects.yaml +++ b/.github/workflows/run-projects.yaml @@ -8,26 +8,37 @@ on: required: true type: number +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + env: ENGINE: "kics" CES_ENVIRONMENT: "prod" permissions: - id-token: write + id-token: read # default deny-write baseline; the run-projects job below elevates to write for AWS OIDC jobs: setup: + name: Setup runs-on: cx-public-ubuntu-x64 outputs: machines: ${{ steps.set-machines.outputs.machines }} + env: + MACHINES_COUNT: ${{ inputs.machines-count }} + MACHINES_MATRIX: ${{ matrix.machine }} steps: - name: Generate Machine Matrix id: set-machines run: | - machines=$(seq -s, 0 $((${{ inputs.machines-count }} - 1))) + machines=$(seq -s, 0 $(("${MACHINES_COUNT}" - 1))) echo "machines=[$machines]" >> "$GITHUB_OUTPUT" run-projects: + name: Run kics againts projects + permissions: + id-token: write # permission to run kics againts project needs: setup runs-on: cx-public-ubuntu-x64 env: @@ -46,14 +57,17 @@ jobs: role-to-assume: ${{ secrets.CES_BUCKET_AWS_ROLE }} aws-region: ${{ secrets.CES_BUCKET_AWS_REGION }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: repository: ${{ secrets.CES_EXECUTOR_REPO }} token: ${{ secrets.GH_TOKEN }} path: cli ref: master + persist-credentials: false - - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 + - name: Setup Go + uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0 with: go-version-file: cli/go.mod cache: false @@ -81,7 +95,7 @@ jobs: - name: Set log file run: | - LOG_FILE="$GITHUB_WORKSPACE/log_${{ matrix.machine }}.log" + LOG_FILE="$GITHUB_WORKSPACE/log_"${MACHINES_MATRIX}".log" echo "LOG_FILE=$LOG_FILE" >> $GITHUB_ENV - name: Select Projects @@ -91,8 +105,8 @@ jobs: ./executor sources \ -s $GITHUB_WORKSPACE/zips/ \ -e $ENGINE \ - --chunk ${{ matrix.machine }} \ - --machines ${{ inputs.machines-count }} \ + --chunk "${MACHINES_MATRIX}" \ + --machines "${MACHINES_COUNT}" \ >> "$LOG_FILE" 2>&1 - name: Prepare Projects diff --git a/.github/workflows/sec-checks.yaml b/.github/workflows/sec-checks.yaml index d659ef5a58f..ebb3c099698 100644 --- a/.github/workflows/sec-checks.yaml +++ b/.github/workflows/sec-checks.yaml @@ -7,6 +7,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: trivy-file-system: name: Trivy fs scan @@ -14,6 +18,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run Trivy vulnerability scanner in repo mode uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 #v0.35.0 with: @@ -34,6 +40,7 @@ jobs: with: name: trivy-fs-scan-results path: ./results.txt + trivy-docker-image: name: Trivy docker image scan runs-on: cx-public-ubuntu-x64 @@ -44,7 +51,9 @@ jobs: steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up Docker Buildx + with: + persist-credentials: false + - name: Setup Docker Buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Build id: docker_build @@ -62,7 +71,7 @@ jobs: cache-from: type=local,src=/tmp/.buildx-cache cache-to: type=local,dest=/tmp/.buildx-cache - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 #v0.35.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 #v0.36.0 with: image-ref: kics:sec-trivy-tests-${{ github.sha }} ignore-unfixed: true @@ -82,21 +91,25 @@ jobs: with: name: trivy-docker-image-scan-results path: ./results.txt + grype-file-system: name: Grype fs scan runs-on: cx-public-ubuntu-x64 steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run Grype vulnerability scanner in repo mode id: grype-fs-scan - uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # 7.2.2 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # 7.4.0 with: path: "." only-fixed: true output-format: table severity-cutoff: low fail-build: true + grype-docker-image: name: Grype docker image scan runs-on: cx-public-ubuntu-x64 @@ -109,7 +122,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - name: Set up Docker Buildx + - name: Setup Docker Buildx uses: step-security/setup-buildx-action@f931205d68723ad9589fd2a7e2ece238bf9de341 # v4.0.0 - name: Build id: docker_build @@ -128,24 +141,28 @@ jobs: cache-to: type=local,dest=/tmp/.buildx-cache - name: Scan image id: grype-image-scan - uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # 7.2.2 + uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # 7.4.0 with: image: kics:sec-tests-${{ github.sha }} only-fixed: true severity-cutoff: low output-format: table fail-build: true + govulncheck-file-system: runs-on: cx-public-ubuntu-x64 name: govulncheck fs scan steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 + with: + persist-credentials: false + - name: Setup Go + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version: 'stable' - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@latest + run: go install golang.org/x/vuln/cmd/govulncheck@617f44b718537dccdea1915395650e0529e3b72e # master 08/19/26 - name: Run govulncheck scanner in fs mode run: | govulncheck -show verbose -C . ./... > ./results.txt || true @@ -159,19 +176,23 @@ jobs: with: name: govulncheck-fs-scan-results path: ./results.txt + govulncheck-binary: runs-on: cx-public-ubuntu-x64 name: govulncheck binary scan steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + with: + persist-credentials: false + - name: Setup Go + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: 'stable' - name: Build kics run: go build -ldflags "-s -w" -a -installsuffix cgo -o ./bin/kics ./cmd/console/main.go - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@latest + run: go install golang.org/x/vuln/cmd/govulncheck@617f44b718537dccdea1915395650e0529e3b72e # master 08/19/26 - name: Run govulncheck scanner in binary mode run: | govulncheck -show verbose -mode=binary ./bin/kics > ./results.txt || true diff --git a/.github/workflows/sonarcloud-scan-branch.yml b/.github/workflows/sonarcloud-scan-branch.yml index a3ef48d1d3e..b1a8a40ea4c 100644 --- a/.github/workflows/sonarcloud-scan-branch.yml +++ b/.github/workflows/sonarcloud-scan-branch.yml @@ -10,20 +10,26 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: sonarcloud: + name: SonarCloud permissions: contents: read # for actions/checkout to fetch code pull-requests: read # for SonarSource/sonarcloud-github-action to determine which PR to decorate - name: SonarCloud runs-on: cx-public-ubuntu-x64 steps: - name: Check out the repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.event.inputs.branch }} + persist-credentials: false - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@ba3875ecf642b2129de2b589510c81a8b53dbf4e # master + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: https://sonarcloud.io diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index ffcbc55496b..3b6a0b01ba9 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -7,20 +7,27 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: sonarcloud: + name: SonarCloud permissions: contents: read # for actions/checkout to fetch code pull-requests: read # for SonarSource/sonarcloud-github-action to determine which PR to decorate - name: SonarCloud runs-on: cx-public-ubuntu-x64 if: github.repository == 'Checkmarx/kics' steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis + persist-credentials: false - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@ba3875ecf642b2129de2b589510c81a8b53dbf4e # master + uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} + SONAR_HOST_URL: https://sonarcloud.io diff --git a/.github/workflows/statistics.yaml b/.github/workflows/statistics.yaml index bc32dbda6e8..9948cc43b3c 100644 --- a/.github/workflows/statistics.yaml +++ b/.github/workflows/statistics.yaml @@ -7,6 +7,10 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: statistics: name: test-statistics @@ -14,10 +18,13 @@ jobs: steps: - name: Checkout Source uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Set up Go + with: + persist-credentials: false + - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 #v6.3.0 with: go-version-file: go.mod + cache: false - name: Run test metrics script id: testcoverage run: | @@ -36,6 +43,10 @@ jobs: python-version: "3.x" - name: Run test statistics script id: metrics + env: + COVERAGE: ${{steps.testcoverage.outputs.coverage}} + LOC: ${{steps.go_loc.outputs.goloc}} + TOTAL_TESTS: ${{steps.testcoverage.outputs.total_tests}} run: | pip3 install -r .github/scripts/statistics/requirements.txt - python3 .github/scripts/statistics/get_statistics.py -c ${{steps.testcoverage.outputs.coverage}} -t ${{steps.testcoverage.outputs.total_tests}} -g ${{steps.go_loc.outputs.goloc}} + python3 .github/scripts/statistics/get_statistics.py -c "${COVERAGE}" -t "${TOTAL_TESTS}" -g "${LOC}" diff --git a/.github/workflows/update-docs-queries.yaml b/.github/workflows/update-docs-queries.yaml index d49f7e62c66..96282b058c8 100644 --- a/.github/workflows/update-docs-queries.yaml +++ b/.github/workflows/update-docs-queries.yaml @@ -12,22 +12,30 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: update-docs: + name: Update queries documentation permissions: actions: write # for styfle/cancel-workflow-action to cancel/stop running workflows - contents: read # for actions/checkout to fetch code - name: Update queries documentation + contents: write # for actions/checkout to fetch code and create-pull-request to push a branch + pull-requests: write # for create-pull-request to open the PR runs-on: cx-public-ubuntu-x64 steps: - name: Cancel Previous Runs uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1 with: access_token: ${{ github.token }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 + persist-credentials: false + - name: Setup Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" - name: Update docs @@ -48,10 +56,9 @@ jobs: uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1 with: title: "docs(queries): update queries catalog" - token: ${{ secrets.KICS_BOT_PAT }} commit-message: "docs(queries): update queries catalog" delete-branch: true - branch: feature/kicsbot-update-queries-docs + branch: feature/update-queries-docs body: | **Automated Changes** Updating queries' documentation. diff --git a/.github/workflows/update-docs-release.yaml b/.github/workflows/update-docs-release.yaml index 8ae15925be2..550036e6753 100644 --- a/.github/workflows/update-docs-release.yaml +++ b/.github/workflows/update-docs-release.yaml @@ -8,12 +8,16 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: update-docs-release: + name: Create new docs version permissions: actions: write # for styfle/cancel-workflow-action to cancel/stop running workflows contents: write # for Git to git push - name: Create new docs version runs-on: cx-public-ubuntu-x64 if: "!github.event.release.prerelease" steps: @@ -25,6 +29,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Get release version id: version run: | @@ -33,34 +38,48 @@ jobs: echo "::set-output name=pversion::$(git describe --abbrev=0 --match='v*' --tags $(git rev-list --tags --skip=1 --max-count=1) | cut -c2-)" echo "::set-output name=ptag::$(git describe --abbrev=0 --match='v*' --tags $(git rev-list --tags --skip=1 --max-count=1))" - name: Print tags + env: + PREVIOUS_TAG: ${{ steps.version.outputs.ptag }} + CURRENT_TAG: ${{ steps.version.outputs.ctag }} + PREVIOUS_VERSION: ${{ steps.version.outputs.pversion }} + CURRENT_VERSION: ${{ steps.version.outputs.cversion }} run: | - echo "prev tag ${{ steps.version.outputs.ptag }}" - echo "curr tag ${{ steps.version.outputs.ctag }}" - echo "prev ver ${{ steps.version.outputs.pversion }}" - echo "curr ver ${{ steps.version.outputs.cversion }}" - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 + echo "prev tag ${PREVIOUS_TAG}" + echo "curr tag ${CURRENT_TAG}" + echo "prev ver ${PREVIOUS_VERSION}" + echo "curr ver ${CURRENT_VERSION}" + - name: Setup Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: 3.x - name: Install dependencies run: pip install mkdocs-bootswatch mike mkdocs-material - - name: Config KICSBot git user + - name: Config git user run: | - git config --global user.name "KICSBot" - git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com" + git config --global user.name "${GITHUB_ACTOR}" + git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com" - name: Checkout previous tag + env: + PREVIOUS_TAG: ${{ steps.version.outputs.ptag }} run: | - git checkout ${{ steps.version.outputs.ptag }} + git checkout "${PREVIOUS_TAG}" - name: Mike deploy previous version + env: + PREVIOUS_VERSION: ${{ steps.version.outputs.pversion }} run: | - mike delete ${{ steps.version.outputs.pversion }} || echo 'version does not exists yet' - mike deploy ${{ steps.version.outputs.pversion }} + mike delete "${PREVIOUS_VERSION}" || echo 'version does not exists yet' + mike deploy "${PREVIOUS_VERSION}" - name: Checkout current tag + env: + CURRENT_TAG: ${{ steps.version.outputs.ctag }} run: | - git checkout ${{ steps.version.outputs.ctag }} + git checkout "${CURRENT_TAG}" - name: Mike deploy current version + env: + CURRENT_VERSION: ${{ steps.version.outputs.cversion }} run: | mike delete latest - mike deploy latest ${{ steps.version.outputs.cversion }} + mike deploy latest "${CURRENT_VERSION}" - name: Fix version selector run: | git checkout gh-pages diff --git a/.github/workflows/update-infra-version.yaml b/.github/workflows/update-infra-version.yaml deleted file mode 100644 index af136ec4599..00000000000 --- a/.github/workflows/update-infra-version.yaml +++ /dev/null @@ -1,32 +0,0 @@ -name: update-infra-version - -on: - workflow_dispatch: - release: - type: [published] - -permissions: - contents: read - -jobs: - update-infra-version: - name: Updates infra with new release - runs-on: cx-public-ubuntu-x64 - if: "!github.event.release.prerelease" - steps: - - name: Checkout project - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - name: Update Terraform Cloud Integration - uses: step-security/repository-dispatch@1a81ac1c72a4ad222c516293b6adf56b34c4cffd # v4.0.2 - with: - token: ${{ secrets.KICS_BOT_PAT }} - repository: ${{ secrets.TFC_REPO_PATH }} - event-type: new-release - - name: Update Infra - uses: step-security/repository-dispatch@1a81ac1c72a4ad222c516293b6adf56b34c4cffd # v4.0.2 - with: - token: ${{ secrets.KICS_BOT_PAT }} - repository: ${{ secrets.INFRA_REPO }} - event-type: new-release diff --git a/.github/workflows/update-install-script.yaml b/.github/workflows/update-install-script.yaml index ff26f5c4522..0b1da954ac3 100644 --- a/.github/workflows/update-install-script.yaml +++ b/.github/workflows/update-install-script.yaml @@ -6,22 +6,29 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: update-install: + name: Update install script permissions: actions: write # for styfle/cancel-workflow-action to cancel/stop running workflows contents: read # for actions/checkout to fetch code - name: Update install script runs-on: cx-public-ubuntu-x64 + env: + GH_TOKEN: ${{ github.token }} steps: - name: Cancel Previous Runs uses: styfle/cancel-workflow-action@85880fa0301c86cca9da44039ee3bb12d3bedbfa # 0.12.1 with: - access_token: ${{ github.token }} + access_token: "${GH_TOKEN}" - name: Checkout project uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 + persist-credentials: false - name: Get Godownloader env: BASE_URL: https://github.com/goreleaser/godownloader/releases/download @@ -36,7 +43,8 @@ jobs: && chmod +x godownloader \ && rm -vf $(basename "${FULL_URL}") \ && cd "${PROJDIR}" - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 + - name: Setup Python + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" - name: Install dependencies @@ -54,7 +62,9 @@ jobs: print(f"::set-output name=goreleaser::{file_content}", end='') shell: python3 {0} - name: Update install.sh - run: ./.bin/godownloader --repo Checkmarx/kics <(echo ${{ steps.outputs.filter.goreleaser }}) > install.sh + env: + GO_RELEASER: ${{ steps.filter.outputs.goreleaser }} + run: ./.bin/godownloader --repo Checkmarx/kics <(echo "${GO_RELEASER}") > install.sh - name: Create Pull Request uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1 with: @@ -62,7 +72,7 @@ jobs: token: ${{ secrets.KICS_BOT_PAT }} delete-branch: true commit-message: "chore(install): update install script" - branch: feature/kicsbot-update-install-script + branch: feature/update-install-script base: master body: | **Automated Changes** diff --git a/.github/workflows/update_software_versions.yml b/.github/workflows/update_software_versions.yml index 7a95cf74f1e..a46993ff077 100644 --- a/.github/workflows/update_software_versions.yml +++ b/.github/workflows/update_software_versions.yml @@ -1,16 +1,28 @@ name: update-software-versions on: workflow_dispatch: + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: update-software-versions: name: update software versions to latest runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code steps: - name: Checkout project uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + persist-credentials: false + - name: Setup Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.x" - name: Run update_versions script diff --git a/.github/workflows/validate-ansible-samples.yml b/.github/workflows/validate-ansible-samples.yml index 101108ff83a..ae7afabb313 100644 --- a/.github/workflows/validate-ansible-samples.yml +++ b/.github/workflows/validate-ansible-samples.yml @@ -10,8 +10,13 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: lint-samples: + name: Lint Ansible Samples runs-on: cx-public-ubuntu-x64 steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/validate-arm-samples.yaml b/.github/workflows/validate-arm-samples.yaml index c6f2e265905..2727a165073 100644 --- a/.github/workflows/validate-arm-samples.yaml +++ b/.github/workflows/validate-arm-samples.yaml @@ -8,18 +8,25 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: lint-json-samples: + name: Lint ARM JSON Samples runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0 + - name: Setup Node + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0 with: node-version: "20" - name: Installing jsonlint - run: | + run: | # zizmor: ignore[adhoc-packages] single small CLI lint tool pinned to an exact version, not a project dependency warranting its own lockfile npm install -g --ignore-scripts jsonlint@1.6.3 - name: Running JSON lint run: | diff --git a/.github/workflows/validate-cfn-samples.yml b/.github/workflows/validate-cfn-samples.yml index 326fcbd09e5..0b6c5a4cf25 100644 --- a/.github/workflows/validate-cfn-samples.yml +++ b/.github/workflows/validate-cfn-samples.yml @@ -7,14 +7,27 @@ on: - "assets/queries/cloudFormation/**/test/*.yaml" - "assets/queries/cloudFormation/**/test/*.json" +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: validate-cfn-syntax: + name: Validate Cloudformation Syntax runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: read # for lots0logs/gh-action-get-changed-files to read the PR's changed file list steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - name: Setup python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.x' - name: Get commit changed files diff --git a/.github/workflows/validate-dkr-samples.yml b/.github/workflows/validate-dkr-samples.yml index 0aa48824d7a..ba73e18bcc1 100644 --- a/.github/workflows/validate-dkr-samples.yml +++ b/.github/workflows/validate-dkr-samples.yml @@ -8,11 +8,17 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: validate-dockerfile-syntax: + name: Validate Dockerfile Syntax runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Get Hadolint diff --git a/.github/workflows/validate-issues.yaml b/.github/workflows/validate-issues.yaml index 35063bc4c42..a3d488f08d8 100644 --- a/.github/workflows/validate-issues.yaml +++ b/.github/workflows/validate-issues.yaml @@ -2,12 +2,26 @@ name: validate-issues on: issues: types: [opened, edited, reopened] + +concurrency: + group: ${{ github.workflow }}-${{ github.event.issue.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # default deny-write baseline; jobs below elevate as needed + jobs: title-check: + name: Title Check runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code; comment actions use KICS_BOT_PAT, not GITHUB_TOKEN env: BODY: ${{ github.event.issue.body }} TITLE: ${{ github.event.issue.title }} + KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }} + GITHUB_REPO: ${{ github.repository }} + GITHUB_ISSUE: ${{ github.event.issue.number }} steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -17,7 +31,7 @@ jobs: .github/scripts/pr-issue-info/issue-fail.md .github/scripts/pr-issue-info/get_title_types.py .github/issue-title-types.yaml - - name: Set up Python + - name: Setup Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" @@ -33,8 +47,8 @@ jobs: - name: Check for comment tag if: env.TITLE_CHECK_FAILED != 'true' run: | - comments=$(curl -s -H "Authorization: token ${{ secrets.KICS_BOT_PAT }}" \ - -X GET "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/comments") + comments=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" \ + -X GET "https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/comments") if echo "$comments" | grep -q "title_check"; then echo "TAG_EXISTS=true" >> $GITHUB_ENV else @@ -61,12 +75,22 @@ jobs: - name: Workflow failed if: env.TITLE_CHECK_FAILED == 'true' run: exit 1 + labels-check: + name: Check Labels runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code + issues: write # to add/remove labels on the issue via GITHUB_TOKEN env: BODY: ${{ github.event.issue.body }} LABELS: ${{ toJson(github.event.issue.labels) }} TITLE: ${{ github.event.issue.title }} + KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }} + USERNAME: ${{ github.event.issue.user.login }}" + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_REPO: ${{ github.repository }} + GITHUB_ISSUE: ${{ github.event.issue.number }} steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -78,10 +102,10 @@ jobs: - name: Install JQ run: sudo apt-get install jq - name: Get username - run: echo "USERNAME=${{ github.event.issue.user.login }}" >> $GITHUB_ENV + run: echo "USERNAME="${USERNAME}"" >> $GITHUB_ENV - name: Check user username run: | - response=$(curl -s -H "Authorization: token ${{ secrets.KICS_BOT_PAT }}" "https://api.github.com/orgs/Checkmarx/teams/kics/members") + response=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" "https://api.github.com/orgs/Checkmarx/teams/kics/members") team_members=$(echo "$response" | jq -r '.[].login') if echo "${team_members[@]}" | grep -Pq "^$USERNAME$"; then echo "Contributor belongs to Checkmarx organization" @@ -94,50 +118,50 @@ jobs: - name: Add community label if user does not belong to Checkmarx Organization run: | if [[ "$IS_MEMBER" == "false" ]]; then - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels -d '{"labels": ["community"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels -d '{"labels": ["community"]}' fi - name: Add feature or feature request label run: | if [[ "$TITLE" == feat* ]] || echo "$TITLE $BODY" | grep -iqP "feature request" || echo "$BODY" | grep -iqP "Is your feature request related to a problem? Please describe." || echo "$BODY" | grep -iqP "Describe the solution you'd like" || echo "$BODY" | grep -iqP "Describe alternatives you've considered" || echo "$BODY" | grep -iqP "Additional context"; then if [[ "$IS_MEMBER" == "true" ]]; then echo "Adding 'feature' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels -d '{"labels": ["feature"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels -d '{"labels": ["feature"]}' else echo "Adding 'feature request' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels -d '{"labels": ["feature request"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels -d '{"labels": ["feature request"]}' fi else if echo "$LABELS" | grep -q "feature request"; then echo "Removing 'feature request' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels/feature%20request + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels/feature%20request elif echo "$LABELS" | grep -q "feature"; then echo "Removing 'feature' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels/feature + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels/feature fi fi - name: Add bug label run: | if echo "$TITLE $BODY" | grep -iqP "(\\b|_)bugs?(\\b|_)" || echo "$BODY" | grep -iqP "steps to reproduce" || echo "$BODY" | grep -iqP "actual behavior" || echo "$BODY" | grep -iqP "expected behavior"; then echo "Adding 'bug' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels -d '{"labels": ["bug"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels -d '{"labels": ["bug"]}' else if echo "$LABELS" | grep -q "bug"; then echo "Removing 'bug' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels/bug + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels/bug fi fi - name: Add query label run: | if echo "$TITLE $BODY" | grep -iqP "(\\b|_)quer(y|ies)(\\b|_)" || echo "$BODY" | grep -iqP "### Platform" || echo "$BODY" | grep -iqP "### Provider"; then echo "Adding 'query' label... " - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels -d '{"labels": ["query"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels -d '{"labels": ["query"]}' else if echo "$LABELS" | grep -q "query"; then echo "Removing 'query' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels/query + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels/query fi fi - - name: Set up Python + - name: Setup Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.x" @@ -159,9 +183,9 @@ jobs: label=${keywords[$keyword]} if [[ ! " ${labels_to_add[@]} " =~ " ${label} " ]] && [[ " ${current_labels[@]} " =~ " ${label} " ]]; then echo "Removing '$label' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels/$label + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels/$label elif [[ " ${labels_to_add[@]} " =~ " ${label} " ]] && [[ ! " ${current_labels[@]} " =~ " ${label} " ]]; then echo "Adding '$label' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/labels -d "{\"labels\": [\"$label\"]}" + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_ISSUE}"/labels -d "{\"labels\": [\"$label\"]}" fi done diff --git a/.github/workflows/validate-k8s-samples.yml b/.github/workflows/validate-k8s-samples.yml index 50eedf049a5..a30158f0972 100644 --- a/.github/workflows/validate-k8s-samples.yml +++ b/.github/workflows/validate-k8s-samples.yml @@ -9,11 +9,17 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: validate-k8s-manifests: + name: Validate Kubernetes Manifests runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Get Kubeval diff --git a/.github/workflows/validate-openapi-samples.yaml b/.github/workflows/validate-openapi-samples.yaml index 19c53493018..c10011bd440 100644 --- a/.github/workflows/validate-openapi-samples.yaml +++ b/.github/workflows/validate-openapi-samples.yaml @@ -9,11 +9,17 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: lint-yaml-samples: + name: Validate Yaml samples runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: yaml-lint @@ -22,17 +28,21 @@ jobs: file_or_dir: assets/queries/openAPI/ config_file: .github/scripts/samples-linters/yamllint.yml strict: true + lint-json-samples: + name: Validate json samples runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0 + - name: Setup Node + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f #v6.3.0 with: node-version: '20' - name: Installing jsonlint - run: | + run: | # zizmor: ignore[adhoc-packages] single small CLI lint tool pinned to an exact version, not a project dependency warranting its own lockfile npm install -g --ignore-scripts jsonlint@1.6.3 npm show jsonlint which jsonlint diff --git a/.github/workflows/validate-prs.yaml b/.github/workflows/validate-prs.yaml index 11e1c3f58ba..a6fe14f2f7b 100644 --- a/.github/workflows/validate-prs.yaml +++ b/.github/workflows/validate-prs.yaml @@ -1,19 +1,32 @@ name: validate-prs on: + # zizmor: ignore[dangerous-triggers] needs secrets/write access to label & comment on PRs from forks; + # checkout never overrides ref, so it always checks out the trusted base branch, never the PR head, + # and no PR-supplied content is ever executed as code (only compared/sent as plain data) pull_request_target: types: [opened, synchronize, edited, reopened] branches: - master + concurrency: group: validate-prs-${{ github.event.pull_request.number }} cancel-in-progress: true + +permissions: + contents: read # default deny-write baseline; jobs below elevate as needed + jobs: title-check: + name: Check Title timeout-minutes: 1 runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code; comment actions use KICS_BOT_PAT, not GITHUB_TOKEN env: ERROR_MSG: "The PR title does not match the required format: (): " TITLE: ${{ github.event.pull_request.title }} + GITHUB_REPO: ${{ github.repository }} + GITHUB_PR: ${{ github.event.pull_request.number }} steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -25,7 +38,7 @@ jobs: .github/scripts/pr-issue-info/title-fail.md - name: Print PR Title run: echo "$TITLE" - - name: Set up Python + - name: Setup Python uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #v6.2.0 with: python-version: "3.x" @@ -41,8 +54,8 @@ jobs: - name: Check for comment tag if: env.TITLE_CHECK_FAILED != 'true' run: | - comments=$(curl -s -H "Authorization: token ${{ secrets.KICS_BOT_PAT }}" \ - -X GET "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments") + comments=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" \ + -X GET "https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/comments") if echo "$comments" | grep -q "title_check"; then echo "TAG_EXISTS=true" >> $GITHUB_ENV else @@ -56,7 +69,7 @@ jobs: Deleting comment, please refresh the page... comment-tag: title_check mode: delete - github-token: ${{ secrets.KICS_BOT_PAT }} + github-token: "${KICS_BOT_PAT}" - name: Add comment if title fails if: env.TITLE_CHECK_FAILED == 'true' uses: step-security/actions-comment-pull-request@60cd38988a354b2d22b47612fb02a20e822d6048 # v3.0.2 @@ -65,17 +78,25 @@ jobs: comment-tag: title_check mode: recreate create-if-not-exists: true - github-token: ${{ secrets.KICS_BOT_PAT }} + github-token: "${KICS_BOT_PAT}" - name: Workflow failed if: env.TITLE_CHECK_FAILED == 'true' run: exit 1 + labels-check: + name: Check Labels runs-on: cx-public-ubuntu-x64 timeout-minutes: 1 + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: write # to add/remove labels on the PR via GITHUB_TOKEN env: BODY: ${{ github.event.pull_request.body }} LABELS: ${{ toJson(github.event.pull_request.labels) }} TITLE: ${{ github.event.pull_request.title }} + USERNAME: ${{ github.event.pull_request.user.login }} + KICS_BOT_PAT: ${{ secrets.KICS_BOT_PAT }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -84,13 +105,11 @@ jobs: sparse-checkout: | .github/scripts/pr-issue-info/get_keywords.py .github/keywords.yaml - - name: Get username - run: echo "USERNAME=${{ github.event.pull_request.user.login }}" >> $GITHUB_ENV - name: Install JQ run: sudo apt-get install jq - name: Check user username - run: | - response=$(curl -s -H "Authorization: token ${{ secrets.KICS_BOT_PAT }}" "https://api.github.com/orgs/Checkmarx/teams/kics/members") + run: | # zizmor: ignore[github-env] is_member is always a literal "true"/"false" set by this script, never derived from untrusted input + response=$(curl -s -H "Authorization: token "${KICS_BOT_PAT}"" "https://api.github.com/orgs/Checkmarx/teams/kics/members") team_members=$(echo "$response" | jq -r '.[].login') if [[ "$USERNAME" == "dependabot[bot]" ]] || echo "${team_members[@]}" | grep -Pq "^$USERNAME$"; then echo "Contributor belongs to Checkmarx organization." @@ -103,61 +122,61 @@ jobs: - name: Add community label if user does not belong to Checkmarx Organization run: | if [[ "$IS_MEMBER" == "false" ]]; then - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d '{"labels": ["community"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d '{"labels": ["community"]}' fi - name: Add feature or feature request label run: | if [[ "$TITLE" == feat* ]]; then if [[ "$IS_MEMBER" == "true" ]]; then echo "Adding 'feature' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d '{"labels": ["feature"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d '{"labels": ["feature"]}' else echo "Adding 'feature request' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d '{"labels": ["feature request"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d '{"labels": ["feature request"]}' fi else if echo "$LABELS" | grep -q "feature request"; then echo "Removing 'feature request' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/feature%20request + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels/feature%20request elif echo "$LABELS" | grep -q "feature"; then echo "Removing 'feature' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/feature + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels/feature fi fi - name: Add documentation label run: | if [[ "$TITLE" == docs* ]]; then echo "Adding 'documentation' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d '{"labels": ["documentation"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d '{"labels": ["documentation"]}' else if echo "$LABELS" | grep -q "documentation"; then echo "Removing 'documentation' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/documentation + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels/documentation fi fi - name: Add bug label run: | if echo "$TITLE $BODY" | grep -iqP "(\\b|_)bugs?(\\b|_)"; then echo "Adding 'bug' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d '{"labels": ["bug"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d '{"labels": ["bug"]}' else if echo "$LABELS" | grep -q "bug"; then echo "Removing 'bug' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/bug + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels/bug fi fi - name: Add query label run: | if echo "$TITLE $BODY" | grep -iqP "(\\b|_)quer(y|ies)(\\b|_)"; then echo "Adding 'query' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d '{"labels": ["query"]}' + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d '{"labels": ["query"]}' else if echo "$LABELS" | grep -q "query"; then echo "Removing 'query' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/query + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels/query fi fi - - name: Set up Python + - name: Setup Python uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: "3.x" @@ -182,10 +201,10 @@ jobs: label=${keywords[$keyword]} if [[ ! " ${labels_to_add[@]} " =~ " ${label} " ]] && [[ " ${current_labels[@]} " =~ " ${label} " ]]; then echo "Removing '$label' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/$label + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X DELETE -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels/$label elif [[ " ${labels_to_add[@]} " =~ " ${label} " ]] && [[ ! " ${current_labels[@]} " =~ " ${label} " ]]; then echo "Adding '$label' label..." - curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels -d "{\"labels\": [\"$label\"]}" + curl -s -H "Authorization: token "${GITHUB_TOKEN}"" -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/"${GITHUB_REPO}"/issues/"${GITHUB_PR}"/labels -d "{\"labels\": [\"$label\"]}" fi done diff --git a/.github/workflows/validate-queries-metadata.yml b/.github/workflows/validate-queries-metadata.yml index 7f214982946..41c8773f5c0 100644 --- a/.github/workflows/validate-queries-metadata.yml +++ b/.github/workflows/validate-queries-metadata.yml @@ -5,9 +5,20 @@ on: paths: - "assets/queries/**/metadata.json" +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read # for actions/checkout to fetch code + jobs: validate-metadata: + name: Validate Queries Metadata runs-on: cx-public-ubuntu-x64 + permissions: + contents: read # for actions/checkout to fetch code + pull-requests: read # queries-validator.py reads the PR's changed file list via the GitHub API steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: diff --git a/.github/workflows/validate-tf-samples.yml b/.github/workflows/validate-tf-samples.yml index f111ec23d28..747e98e364e 100644 --- a/.github/workflows/validate-tf-samples.yml +++ b/.github/workflows/validate-tf-samples.yml @@ -8,11 +8,17 @@ on: permissions: contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + jobs: lint-samples: + name: Validate Terraform Samples runs-on: cx-public-ubuntu-x64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - name: Checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Get tflint diff --git a/Dockerfile b/Dockerfile index ba27f5510fc..4cf73ab45c5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ -ARG GO_BASE_IMAGE=checkmarx/go:1.26.4@sha256:cb8702a93db4a4b07da9c6e6e93bf412091e7b121b6ade95aa4228ec5fae4301 -ARG GIT_BASE_IMAGE=checkmarx/git:2.55.0@sha256:25f9c40d0991aeb3fab4f68bc8b96e9af819ebf3bcd2d882eb1f735a03485967 +ARG GO_BASE_IMAGE=checkmarx/go:1.26.6@sha256:15acaa5ad7f0dafe2a2d780510f0ecdbbc326adde6351ec48a85189fc7f03913 +ARG GIT_BASE_IMAGE=checkmarx/git:2.55.0@sha256:0d5046d922ec41bb54b05568f998c4685d3697f25bf6bfb4e5a54ab198f12f8d FROM ${GO_BASE_IMAGE} AS build_env # Copy the source from the current directory to the Working Directory inside the container diff --git a/docker/Dockerfile.alpine b/docker/Dockerfile.alpine index 2d4195624c9..4a46c513890 100644 --- a/docker/Dockerfile.alpine +++ b/docker/Dockerfile.alpine @@ -1,7 +1,4 @@ -FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26.2-alpine AS build_env - -# Install build dependencies -RUN apk add --no-cache git +FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26.2@sha256:b54cbf583d390341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716 AS build_env # Copy the source from the current directory to the Working Directory inside the container WORKDIR /app @@ -29,11 +26,8 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \ -a -installsuffix cgo \ -o bin/kics cmd/console/main.go -# Runtime image - Alpine base with apk support -FROM alpine:latest - -# Install runtime dependencies including git for scanning repositories -RUN apk add --no-cache git wget unzip +# Runtime image - Alpine base with git preinstalled (wget/unzip come from busybox already) +FROM alpine/git:latest@sha256:3b44767883ac77bddae0160cc27b6b039345e23fa3504f4159efaa32264ab57f RUN addgroup -g 1000 checkmarx && \ adduser -D -u 1000 -G checkmarx -h /app/bin -s /bin/sh checkmarx @@ -51,7 +45,7 @@ WORKDIR /app/bin USER checkmarx # Add kics to PATH -ENV PATH $PATH:/app/bin +ENV PATH=$PATH:/app/bin # Healthcheck the container (consistent with Debian variant) HEALTHCHECK CMD wget -q --method=HEAD localhost/system-status.txt diff --git a/docker/Dockerfile.antlr b/docker/Dockerfile.antlr index 59dfd91819a..c1e15317e22 100644 --- a/docker/Dockerfile.antlr +++ b/docker/Dockerfile.antlr @@ -5,7 +5,6 @@ WORKDIR /opt/antlr4 ARG ANTLR_VERSION="4.13.1" ARG MAVEN_OPTS="-Xmx1G" - RUN apk add --no-cache maven git \ && git clone https://github.com/antlr/antlr4.git \ && cd antlr4 \ @@ -30,6 +29,9 @@ RUN adduser \ "${user}" COPY --from=builder /opt/antlr4/antlr4/antlr4-tool.jar /usr/local/lib/ + WORKDIR /work + ENTRYPOINT ["java", "-Xmx500M", "-cp", "/usr/local/lib/antlr4-tool.jar", "org.antlr.v4.Tool"] + CMD [ "-Dlanguage=Go", "-visitor", "-no-listener", "-o", "parser", "jsonfilter/JSONFilter.g4", "-Dlanguage=Go", "-visitor", "-no-listener", "-o", "parser", "bicep/antlr/bicep.g4"] diff --git a/docker/Dockerfile.debian b/docker/Dockerfile.debian index 7a04793f051..cd313b5b03d 100644 --- a/docker/Dockerfile.debian +++ b/docker/Dockerfile.debian @@ -3,13 +3,18 @@ # it does not define an ENTRYPOINT as this is a requirement described here: # https://docs.microsoft.com/en-us/azure/devops/pipelines/process/container-phases?view=azure-devops#linux-based-containers # -FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26.2-bookworm as build_env +FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:1.26.2-bookworm@sha256:47ce5636e9936b2c5cbf708925578ef386b4f8872aec74a67bd13a627d242b19 AS build_env + # Create a group and user RUN groupadd checkmarx && useradd -g checkmarx -M -s /bin/bash checkmarx + USER checkmarx + # Copy the source from the current directory to the Working Directory inside the container WORKDIR /app + ENV GOPRIVATE=github.com/Checkmarx/* + ARG VERSION="development" ARG COMMIT="NOCOMMIT" ARG SENTRY_DSN="" @@ -20,35 +25,36 @@ ARG TARGETARCH #Copy go mod and sum files COPY --chown=checkmarx:checkmarx go.mod . COPY --chown=checkmarx:checkmarx go.sum . -# Get dependancies - will also be cached if we won't change mod/sum + +# Get dependencies - will also be cached if we won't change mod/sum RUN go mod download -x + # COPY the source code as the last step COPY . . + USER root + # Build the Go app -RUN apt-get install -y ca-certificates RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \ -ldflags "-s -w -X github.com/Checkmarx/kics/v2/internal/constants.Version=${VERSION} -X github.com/Checkmarx/kics/v2/internal/constants.SCMCommit=${COMMIT} -X github.com/Checkmarx/kics/v2/internal/constants.SentryDSN=${SENTRY_DSN} -X github.com/Checkmarx/kics/v2/internal/constants.BaseURL=${DESCRIPTIONS_URL}" \ -a -installsuffix cgo \ -o bin/kics cmd/console/main.go -USER Checkmarx +USER checkmarx -# Healthcheck the container -HEALTHCHECK CMD wget -q --method=HEAD localhost/system-status.txt # # This image can be used as a container agent for the Azure DevOps pipeline # be sure to use /app/bin/kics as a path to the binary # -# runtime image -FROM debian:stable-slim +# runtime image - buildpack-deps:scm already ships git, wget and ca-certificates +FROM buildpack-deps:bookworm-scm@sha256:de4e518f98c6533eceeee6f8b14a77a918856fa8282a1b711c0292d089157c0c RUN groupadd checkmarx && useradd -g checkmarx -M -s /bin/bash checkmarx -ENV PATH /app/bin:/usr/bin/git:$PATH +ENV PATH=/app/bin:/usr/bin/git:$PATH RUN apt-get update -yq \ - && apt-get install git wget unzip zip jq -y \ + && apt-get install unzip zip jq -y \ && apt-get clean \ && rm -rf /var/lib/apt/lists/* @@ -60,7 +66,7 @@ COPY --from=build_env /app/assets/libraries/* /app/bin/assets/libraries/ WORKDIR /app/bin -ENV PATH $PATH:/app/bin -# Healthcheck the container +ENV PATH=$PATH:/app/bin +# Healthcheck the container HEALTHCHECK CMD wget -q --method=HEAD localhost/system-status.txt diff --git a/docker/Dockerfile.ubi8 b/docker/Dockerfile.ubi8 index cbccd03d512..a5c20d88b1f 100644 --- a/docker/Dockerfile.ubi8 +++ b/docker/Dockerfile.ubi8 @@ -1,4 +1,6 @@ -FROM registry.access.redhat.com/ubi8:latest AS build_env +FROM golang:1.26.2@sha256:b54cbf583d390341599d7bcbc062425c081105cc5ef6d170ced98ef9d047c716 AS go_toolchain + +FROM redhat/ubi8:latest@sha256:a94c5e31450d30190afe6f7a09628dd1dd7a3dc98784ba5ed1d19fd77098fcb2 AS build_env ARG TARGETOS ARG TARGETARCH @@ -7,13 +9,7 @@ WORKDIR /build ENV PATH=$PATH:/usr/local/go/bin -RUN echo "Installing Go 1.26.2 for ${TARGETARCH:-amd64} architecture" - -RUN yum install git gcc wget -y \ - && rm -rf /usr/local/go \ - && wget -q https://golang.org/dl/go1.26.2.linux-${TARGETARCH:-amd64}.tar.gz \ - && tar -C /usr/local -xzf go1.26.2.linux-${TARGETARCH:-amd64}.tar.gz \ - && rm -f go1.26.2.linux-${TARGETARCH:-amd64}.tar.gz +COPY --from=go_toolchain /usr/local/go /usr/local/go ENV GOPRIVATE=github.com/Checkmarx/* ARG VERSION="development" @@ -37,7 +33,7 @@ RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \ -a -installsuffix cgo \ -o bin/kics cmd/console/main.go -FROM registry.access.redhat.com/ubi8:latest +FROM redhat/ubi8:latest@sha256:a94c5e31450d30190afe6f7a09628dd1dd7a3dc98784ba5ed1d19fd77098fcb2 ARG RELEASE ARG VERSION @@ -70,7 +66,6 @@ RUN yum install git wget unzip -y \ -s /bin/bash \ ${KUSER} - USER ${KUSER} COPY LICENSE /licenses/LICENSE diff --git a/docs/release_checklist.md b/docs/release_checklist.md index 5a564b3282a..8893b5c55b8 100644 --- a/docs/release_checklist.md +++ b/docs/release_checklist.md @@ -9,7 +9,7 @@ - In the master branch, run `git tag <tag_version>` and `git push -u origin <tag_version>` 6. Test pre-release manually on each platform 7. In [Tags](https://github.com/Checkmarx/kics/tags), create the release for the target version. Do not forget to select "Create a discussion for this release" and check if it was created. -8. Check if `update-docs-release`, `update-infra-version`, and `release-docker-image` workflow completed with success +8. Check if `update-docs-release` and `release-docker-image` workflow completed with success 9. Check if the image is published in [dockerhub](https://hub.docker.com/r/checkmarx/kics) / update hub documentation if changed 10. Push image to Red Hat 11. Update integrations tag: diff --git a/go.mod b/go.mod index 13a4b0a6778..efe892bd27d 100644 --- a/go.mod +++ b/go.mod @@ -40,8 +40,8 @@ require ( github.com/yargevad/filepathx v1.0.0 github.com/zclconf/go-cty v1.16.2 golang.org/x/exp v0.0.0-20260603202125-055de637280b - golang.org/x/net v0.56.0 - golang.org/x/text v0.40.0 + golang.org/x/net v0.58.0 + golang.org/x/text v0.41.0 golang.org/x/tools/godoc v0.1.0-deprecated gopkg.in/yaml.v3 v3.0.1 helm.sh/helm/v3 v3.21.2 @@ -147,8 +147,8 @@ require ( go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/mod v0.37.0 // indirect - golang.org/x/tools v0.47.0 // indirect + golang.org/x/mod v0.40.0 // indirect + golang.org/x/tools v0.49.0 // indirect google.golang.org/api v0.271.0 // indirect google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect @@ -244,11 +244,11 @@ require ( github.com/xlab/treeprint v1.2.0 // indirect github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect github.com/yashtewari/glob-intersection v0.2.0 // indirect - golang.org/x/crypto v0.53.0 // indirect + golang.org/x/crypto v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/term v0.44.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect diff --git a/go.sum b/go.sum index c5b70a29805..78c365b8d17 100644 --- a/go.sum +++ b/go.sum @@ -640,19 +640,19 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20260603202125-055de637280b h1:v1uXiEBHo8QA0LiGCo7UgHMzHT4Kdfpl2zmtH5vaP1Q= golang.org/x/exp v0.0.0-20260603202125-055de637280b/go.mod h1:d2fgXJLVs4dYDHUk5lwMIfzRzSrWCfGZb0ZqeLa/Vcw= golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -668,22 +668,22 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk= golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/pkg/engine/source/filesystem.go b/pkg/engine/source/filesystem.go index c2304077894..c6e1bc86366 100644 --- a/pkg/engine/source/filesystem.go +++ b/pkg/engine/source/filesystem.go @@ -158,7 +158,10 @@ func (s *FilesystemSource) GetQueryLibrary(platform string) (RegoLibraries, erro embeddedLibraryData, errGettingEmbeddedLibraryCode := assets.GetEmbeddedLibraryData(strings.ToLower(platform)) if errGettingEmbeddedLibraryCode != nil { - log.Debug().Msgf("Could not open embedded library data for %s platform", platform) + // only "common" ships embedded library data + if strings.EqualFold(platform, common) { + log.Debug().Msgf("Could not open embedded library data for %s platform", platform) + } embeddedLibraryData = emptyInputData } mergedLibraryData, errMergingLibraryData := MergeInputData(embeddedLibraryData, customLibraryData) diff --git a/pkg/scan/client.go b/pkg/scan/client.go index 4f444a600e5..66d7ea72d48 100644 --- a/pkg/scan/client.go +++ b/pkg/scan/client.go @@ -105,12 +105,16 @@ func CheckVersion(t *tracker.CITracker) { } resp, err := versionHTTPClient.Get(constants.GitHubReleasesURL) - if err != nil { t.TrackVersion(baseVersionInfo) return } - defer resp.Body.Close() + + defer func() { + if err := resp.Body.Close(); err != nil { + log.Err(err) + } + }() if resp.StatusCode == http.StatusNotFound { t.TrackVersion(baseVersionInfo) diff --git a/pkg/scan/post_scan.go b/pkg/scan/post_scan.go index 27a4a642fa9..99ea41fcc26 100644 --- a/pkg/scan/post_scan.go +++ b/pkg/scan/post_scan.go @@ -2,8 +2,6 @@ package scan import ( _ "embed" // Embed kics CLI img and scan-flags - // "encoding/json" - // "fmt" "os" "path/filepath" "sort" diff --git a/pkg/scan/utils.go b/pkg/scan/utils.go index 1b640dd0dbf..9ea7413a42b 100644 --- a/pkg/scan/utils.go +++ b/pkg/scan/utils.go @@ -242,7 +242,7 @@ func usingCustomQueries(queriesPath []string) bool { // printVersionCheck - Prints and logs warning if not using KICS latest version func printVersionCheck(customPrint *consolePrinter.Printer, s *model.Summary) { if !s.LatestVersion.Latest { - message := fmt.Sprintf("A new version '%s' of KICS is available, please consider updating", s.LatestVersion.LatestVersionTag) + message := fmt.Sprintf("A new version 'v%s' of KICS is available, please consider updating", s.LatestVersion.LatestVersionTag) fmt.Println(customPrint.VersionMessage.Sprintf("%s", message)) }