-
Notifications
You must be signed in to change notification settings - Fork 137
85 lines (71 loc) · 2.6 KB
/
rl-scanner.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: RL-Secure
run-name: rl-scanner
on:
merge_group:
workflow_dispatch:
push:
branches: ['master']
permissions:
contents: read
jobs:
rl-scanner:
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request')
runs-on: ubuntu-latest
permissions:
pull-requests: write
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Configure Ruby
uses: ./.github/actions/setup
with:
ruby-version: 3.2
- name: Build RubyGems
shell: bash
run: |
gem build *.gemspec
- name: Output build artifact
id: output_build_artifact
run: |
echo "scanfile=$(ls *.gem)" >> $GITHUB_OUTPUT
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: "3.10"
- name: Install Python dependencies
run: |
pip install --upgrade pip
pip install boto3 requests
- name: Get Artifact Version
id: get_version
run: echo "version=$(cat .version)" >> $GITHUB_ENV
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
with:
role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }}
aws-region: us-east-1
mask-aws-account-id: true
- name: Install rl-wrapper
env:
WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
run: |
pip install rl-wrapper --index-url $WRAPPER_INDEX_URL
- name: Run Reversing Labs Wrapper Scanner
env:
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
PYTHONUNBUFFERED: 1
run: |
pip install rl-wrapper --index-url "$WRAPPER_INDEX_URL" && \
rl-wrapper \
--artifact "${{ steps.output_build_artifact.outputs.scanfile }}" \
--version "${{ steps.get_version.outputs.version }}" \
--name "${{ github.event.repository.name }}" \
--repository "${{ github.repository }}" \
--commit "${{ github.sha }}" \
--build-env "github_actions" \
--suppress_output
continue-on-error: true