From eade3507680bb982b5da2da929254dde8330b2d2 Mon Sep 17 00:00:00 2001 From: Kunal Dawar Date: Thu, 24 Oct 2024 15:48:56 +0530 Subject: [PATCH] Update Scanner --- .github/actions/rl-scanner/action.yml | 70 ++++++++++++++++++++ .github/workflows/release.yml | 17 ++++- .github/workflows/rl-secure.yml | 93 +++++++++++++-------------- 3 files changed, 130 insertions(+), 50 deletions(-) create mode 100644 .github/actions/rl-scanner/action.yml diff --git a/.github/actions/rl-scanner/action.yml b/.github/actions/rl-scanner/action.yml new file mode 100644 index 00000000..0ff7a5de --- /dev/null +++ b/.github/actions/rl-scanner/action.yml @@ -0,0 +1,70 @@ +name: 'Reversing Labs Scanner' +description: 'Runs the Reversing Labs scanner on a specified artifact.' +inputs: + artifact-path: + description: 'Path to the artifact to be scanned.' + required: true + version: + description: 'Version of the artifact.' + required: true + repository: + description: 'GitHub repository name.' + required: true + commit: + description: 'Git commit SHA.' + required: true + +runs: + using: 'composite' + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Install Python dependencies + run: | + pip install --upgrade pip + pip install boto3 requests + + - name: Install RL Wrapper + run: | + pip install rl-wrapper>=1.0.0 --index-url "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple" + + - name: Run RL Scanner + env: + RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} + PYTHONUNBUFFERED: 1 + run: | + if [ ! -f "${{ inputs.artifact-path }}" ]; then + echo "Artifact not found: ${{ inputs.artifact-path }}" + exit 1 + fi + + rl-wrapper \ + --artifact "${{ inputs.artifact-path }}" \ + --name "${{ inputs.repository }}" \ + --version "${{ inputs.version }}" \ + --repository "${{ inputs.repository }}" \ + --commit "${{ inputs.commit }}" \ + --build-env "github_actions" + + # Check the outcome of the scanner + if [ $? -ne 0 ]; then + echo "RL Scanner failed." + echo "scan-status=failed" >> $GITHUB_ENV + exit 1 + else + echo "RL Scanner passed." + echo "scan-status=success" >> $GITHUB_ENV + fi + +outputs: + scan-status: + description: 'The outcome of the scan process.' + value: ${{ env.scan-status }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 592a3e34..4eeedbc1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,7 +5,9 @@ on: types: - closed workflow_dispatch: - + push: + branches: + - 'Add-ReversingLabs-Scanner' permissions: contents: write id-token: write # For publishing to npm using --provenance @@ -15,6 +17,17 @@ permissions: ### TODO: Also remove `npm-release` workflow from this repo's .github/workflows folder once the repo is public. jobs: + rl-scanner: + uses: ./.github/workflows/rl-secure.yml + with: + node-version: 18 + artifact-name: 'auth0-react.tgz' + secrets: + RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} + PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} + PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} release: uses: ./.github/workflows/npm-release.yml with: @@ -22,4 +35,4 @@ jobs: require-build: true secrets: npm-token: ${{ secrets.NPM_TOKEN }} - github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/rl-secure.yml b/.github/workflows/rl-secure.yml index 89d5ba30..0cd37d8c 100644 --- a/.github/workflows/rl-secure.yml +++ b/.github/workflows/rl-secure.yml @@ -1,68 +1,65 @@ name: RL-Secure Workflow -run-name: rl-scanner-only on: - merge_group: - workflow_dispatch: - push: - branches: ['main','Add-ReversingLabs-Scanner'] - -env: - NODE_VERSION: 18 + workflow_call: + inputs: + node-version: + required: true + type: string + artifact-name: + required: true + type: string + secrets: + RL_SECURE_LICENSE: + required: true + RL_SECURE_SITE_KEY: + required: true + SIGNAL_HANDLER_TOKEN: + required: true + PROD_TOOLS_USER: + required: true + PROD_TOOLS_TOKEN: + required: true jobs: - checkout-build-scan-only: + rl-scanner: + name: Run Reversing Labs Scanner runs-on: ubuntu-latest - - permissions: - pull-requests: write - id-token: write + outputs: + scan-status: ${{ steps.rl-scan-conclusion.outcome }} steps: - - uses: actions/checkout@v4 + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 - name: Build package uses: ./.github/actions/build with: - node: ${{ env.NODE_VERSION }} + node: ${{ inputs.node-version }} - name: Create tgz build artifact run: | - tar -czvf auth0-react.tgz * + tar -czvf ${{ inputs.artifact-name }} * - - name: Get Artifact Version - id: get_version - run: echo "version=$(cat .version)" >> $GITHUB_ENV + - id: get_version + uses: ./.github/actions/get-version - - name: Set up Python - uses: actions/setup-python@v4 + - name: Run RL Scanner + id: rl-scan-conclusion + uses: ./.github/actions/rl-scanner with: - python-version: "3.10" - - - name: Install Python dependencies - run: | - pip install --upgrade pip - pip install boto3 requests - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v4 - with: - role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }} - aws-region: us-east-1 - mask-aws-account-id: true - - - name: Run Reversing Labs Wrapper Scanner + artifact-path: "$(pwd)/${{ inputs.artifact-name }}" + version: "${{ steps.get_version.outputs.version }}" + repository: "${{ github.repository }}" + commit: "${{ github.sha }}" env: - RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} - RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + RL_SECURE_LICENSE: ${{ secrets.RL_SECURE_LICENSE }} + RL_SECURE_SITE_KEY: ${{ secrets.RL_SECURE_SITE_KEY }} SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} - WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple" - PYTHONUNBUFFERED: 1 - run: | - pip install rl-wrapper>=1.0.0 --index-url $WRAPPER_INDEX_URL && \ - rl-wrapper \ - --artifact "$(pwd)/auth0-react.tgz" \ - --name "${{ github.event.repository.name }}" \ - --version "${{ env.version }}" \ - --repository "${{ github.repository }}" \ - --commit "${{ github.sha }}" \ - --build-env "github_actions" + PROD_TOOLS_USER: ${{ secrets.PROD_TOOLS_USER }} + PROD_TOOLS_TOKEN: ${{ secrets.PROD_TOOLS_TOKEN }} + + - name: Output scan result + run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV