Skip to content

Commit 98ecddb

Browse files
MionszMionsz
authored
Enable dependabot (#9)
Enable dependabot by adding scheduled weekly tasks . Create dependency-review.yml Create dependency-review.yml workflow for dependabot scheduled actions. Create trivy.yml for enablement of trivy scanning of Dockerfiles and image. Create mock CodeQL script (to-be-done). No real job to be done currently as scripts need to be fixed. Create codeql-config.yml Create docker-build.yml Create docker-build.yml with build script for Dockerfiles and Trivy scan for results, * Update docker-build.yml Fix path issue for docker buildx build. * Update trivy.yml Fix scan-type rootfs and scan-type config as one of them performed checkout. Signed-off-by: Miłosz Linkiewicz <milosz.linkiewicz@intel.com> --------- Signed-off-by: Miłosz Linkiewicz <milosz.linkiewicz@intel.com>
1 parent 0f0b217 commit 98ecddb

6 files changed

Lines changed: 208 additions & 0 deletions

File tree

‎.github/codeql/codeql-config.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
name: "MCM CodeQL Config"

‎.github/dependabot.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /.github
5+
schedule:
6+
interval: "weekly"
7+
day: "sunday"
8+
9+
- package-ecosystem: docker
10+
directory: /docker
11+
schedule:
12+
interval: "weekly"
13+
day: "sunday"

‎.github/workflows/codeql.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "master", "main", "dev" ]
6+
pull_request:
7+
branches: [ "master", "main", "dev" ]
8+
schedule:
9+
- cron: '42 8 * * 1'
10+
11+
env:
12+
# Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
13+
BUILD_TYPE: Release
14+
PREFIX_DIR: /usr/local
15+
DEBIAN_FRONTEND: noninteractive
16+
17+
permissions:
18+
contents: read
19+
20+
jobs:
21+
analyze:
22+
name: Analyze
23+
runs-on: ${{ matrix.runner-os }}
24+
timeout-minutes: 90
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
runner-os: [ 'ubuntu-22.04' ]
29+
permissions:
30+
actions: read
31+
contents: read
32+
security-events: write
33+
defaults:
34+
run:
35+
shell: bash
36+
37+
steps:
38+
- name: 'Harden Runner'
39+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
40+
with:
41+
egress-policy: audit
42+
43+
- name: 'Checkout repository'
44+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
45+
46+
- name: 'Initialize CodeQL'
47+
uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
48+
with:
49+
languages: 'c-cpp'
50+
build-mode: autobuild
51+
# config-file: ${{ github.workspace }}/.github/codeql/codeql-config.yml
52+
53+
- if: matrix.build-mode == 'manual'
54+
shell: bash
55+
run: |
56+
echo 'If you are using a "manual" build mode for one or more of the' \
57+
'languages you are analyzing, replace this with the commands to build' \
58+
'your code, for example:'
59+
echo ' make bootstrap'
60+
echo ' make release'
61+
exit 1
62+
63+
- name: Perform CodeQL Analysis
64+
uses: github/codeql-action/analyze@v3
65+
with:
66+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Dependency Review Action
2+
#
3+
# Source repository: https://github.com/actions/dependency-review-action
4+
name: 'Dependency Review'
5+
on: [pull_request]
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
dependency-review:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: 'Harden Runner'
15+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
16+
with:
17+
egress-policy: audit
18+
19+
- name: 'Checkout Repository'
20+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
21+
22+
- name: 'Dependency Review'
23+
uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3

‎.github/workflows/docker-build.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Docker Build
2+
on:
3+
push:
4+
branches: [ "master", "main" ]
5+
pull_request:
6+
branches: [ "master", "main" ]
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
docker-build:
13+
name: Dockerfiles Build
14+
runs-on: ubuntu-latest
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
dockerfiles: [ 'ubuntu22.04', 'ubuntu18.04', 'centos7.9' ]
19+
permissions:
20+
actions: read
21+
contents: read
22+
security-events: write
23+
defaults:
24+
run:
25+
shell: bash
26+
timeout-minutes: 90
27+
steps:
28+
- name: Harden Runner
29+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
30+
with:
31+
egress-policy: audit
32+
33+
- name: Checkout
34+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
35+
36+
- name: Set up QEMU
37+
uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3.1.0
38+
39+
- name: Set up Docker Buildx
40+
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
41+
with:
42+
buildkitd-flags: --debug
43+
44+
- name: 'Build Dockerfile for ${{ matrix.dockerfiles }}'
45+
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0
46+
with:
47+
file: '${{ github.workspace }}/docker/Dockerfile.${{ matrix.dockerfiles }}'
48+
context: .
49+
push: false
50+
tags: 'docker.io/openvisualcloud/raisr/${{ matrix.dockerfiles }}:${{ github.sha }}'
51+
52+
- name: 'Run Trivy vulnerability scanner on result'
53+
uses: aquasecurity/trivy-action@0.20.0
54+
with:
55+
image-ref: 'docker.io/openvisualcloud/raisr/${{ matrix.dockerfiles }}:${{ github.sha }}'
56+
exit-code: '1'
57+
ignore-unfixed: true
58+
vuln-type: 'os,library'
59+
severity: 'CRITICAL,HIGH'
60+
format: 'sarif'
61+
output: '${{ github.workspace }}/trivy-${{ matrix.dockerfiles }}-${{ github.sha }}.sarif'
62+
63+
- name: 'Upload Trivy scan results to GitHub Security tab'
64+
uses: github/codeql-action/upload-sarif@v2
65+
with:
66+
sarif_file: '${{ github.workspace }}/trivy-${{ matrix.dockerfiles }}-${{ github.sha }}.sarif'

‎.github/workflows/trivy.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Trivy
2+
on:
3+
push:
4+
branches:
5+
- main
6+
pull_request:
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
scan-type-config:
12+
runs-on: ubuntu-22.04
13+
permissions:
14+
contents: read # for actions/checkout to fetch code
15+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
16+
name: scan-type-config
17+
steps:
18+
- name: Harden Runner
19+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
20+
with:
21+
egress-policy: audit
22+
23+
- name: Checkout code
24+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
25+
26+
- name: Run Trivy vulnerability scanner, scan-type=config
27+
uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2 # v0.23.0
28+
with:
29+
scan-type: 'config'
30+
hide-progress: false
31+
ignore-unfixed: true
32+
format: 'sarif'
33+
output: 'trivy-config-results.sarif'
34+
severity: 'CRITICAL,HIGH,MEDIUM'
35+
36+
- name: Upload Trivy config scan results to GitHub Security tab
37+
uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
38+
with:
39+
sarif_file: 'trivy-config-results.sarif'

0 commit comments

Comments
 (0)