From ba9d3788e41756554f71500303a39dbea535b6ef Mon Sep 17 00:00:00 2001 From: Jon Janego Date: Tue, 6 Feb 2024 12:55:25 -0600 Subject: [PATCH 01/25] Changing default behavior to include comment summary in PR also gave the workflow the appropriate permissions required, pull-requests: write --- code-scanning/dependency-review.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/code-scanning/dependency-review.yml b/code-scanning/dependency-review.yml index 14255a917e..74e66ed205 100644 --- a/code-scanning/dependency-review.yml +++ b/code-scanning/dependency-review.yml @@ -20,8 +20,8 @@ on: # https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api permissions: contents: read - # Required if `comment-summary-in-pr: true` is uncommented below - # pull-requests: write + # Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option + pull-requests: write jobs: dependency-review: @@ -32,8 +32,8 @@ jobs: - name: 'Dependency Review' uses: actions/dependency-review-action@v4 # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options. - # with: + with: + comment-summary-in-pr: always # fail-on-severity: moderate - # deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later - # comment-summary-in-pr: true + # deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later # retry-on-snapshot-warnings: true From 8aab15dd49a9ff76eca0fc91767e173f5d0f15d9 Mon Sep 17 00:00:00 2001 From: Jon Janego Date: Wed, 7 Feb 2024 09:06:01 -0600 Subject: [PATCH 02/25] Update code-scanning/dependency-review.yml begone, whitespace Co-authored-by: Chad Bentz <1760475+felickz@users.noreply.github.com> --- code-scanning/dependency-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/dependency-review.yml b/code-scanning/dependency-review.yml index 74e66ed205..14d335c5e8 100644 --- a/code-scanning/dependency-review.yml +++ b/code-scanning/dependency-review.yml @@ -35,5 +35,5 @@ jobs: with: comment-summary-in-pr: always # fail-on-severity: moderate - # deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later + # deny-licenses: GPL-1.0-or-later, LGPL-2.0-or-later # retry-on-snapshot-warnings: true From c4f5db626001352990a0a12dc2e89f4716e9e2a0 Mon Sep 17 00:00:00 2001 From: Sam Partington Date: Wed, 7 Feb 2024 17:33:08 +0000 Subject: [PATCH 03/25] Code Scanning shouldn't own `dependency-review.yml` --- CODEOWNERS | 1 + 1 file changed, 1 insertion(+) diff --git a/CODEOWNERS b/CODEOWNERS index 4389365353..2ed2e33dcf 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,4 +1,5 @@ * @actions/actions-workflow-development-reviewers /code-scanning/ @actions/advanced-security-code-scanning @actions/actions-workflow-development-reviewers @actions/advanced-security-dependency-graph +/code-scanning/dependency-review.yml @actions/actions-workflow-development-reviewers @actions/advanced-security-dependency-graph /pages/ @actions/pages @actions/actions-workflow-development-reviewers From d303234ad7a0c432ed79bc98259043570ea64012 Mon Sep 17 00:00:00 2001 From: daz Date: Tue, 13 Feb 2024 14:00:27 -0700 Subject: [PATCH 04/25] Update for `gradle/actions@v3.1.0` release - Bump version hashes to use `gradle/actions/setup-gradle@v3.1.0` - Bump version hash to use `gradle/actions/dependency-submission@v3.1.0` --- ci/gradle-publish.yml | 2 +- ci/gradle.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/ci/gradle-publish.yml b/ci/gradle-publish.yml index 6cc37c34d5..2af46165be 100644 --- a/ci/gradle-publish.yml +++ b/ci/gradle-publish.yml @@ -30,7 +30,7 @@ jobs: settings-path: ${{ github.workspace }} # location for the settings.xml file - name: Setup Gradle - uses: gradle/actions/setup-gradle@ec92e829475ac0c2315ea8f9eced72db85bb337a # v3.0.0 + uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0 - name: Build with Gradle run: ./gradlew build diff --git a/ci/gradle.yml b/ci/gradle.yml index 361a5d5777..65a332be61 100644 --- a/ci/gradle.yml +++ b/ci/gradle.yml @@ -31,7 +31,7 @@ jobs: # Configure Gradle for optimal use in GiHub Actions, including caching of downloaded dependencies. # See: https://github.com/gradle/actions/blob/main/setup-gradle/README.md - name: Setup Gradle - uses: gradle/actions/setup-gradle@ec92e829475ac0c2315ea8f9eced72db85bb337a # v3.0.0 + uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0 - name: Build with Gradle Wrapper run: ./gradlew build @@ -40,7 +40,7 @@ jobs: # If your project does not have the Gradle Wrapper configured, you can use the following configuration to run Gradle with a specified version. # # - name: Setup Gradle - # uses: gradle/actions/setup-gradle@ec92e829475ac0c2315ea8f9eced72db85bb337a # v3.0.0 + # uses: gradle/actions/setup-gradle@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0 # with: # gradle-version: '8.5' # @@ -64,4 +64,4 @@ jobs: # Generates and submits a dependency graph, enabling Dependabot Alerts for all project dependencies. # See: https://github.com/gradle/actions/blob/main/dependency-submission/README.md - name: Generate and submit dependency graph - uses: gradle/actions/dependency-submission@ec92e829475ac0c2315ea8f9eced72db85bb337a # v3.0.0 + uses: gradle/actions/dependency-submission@417ae3ccd767c252f5661f1ace9f835f9654f2b5 # v3.1.0 From 05e45811599669cf3c0631d7980937988b31be11 Mon Sep 17 00:00:00 2001 From: Marco Gario Date: Thu, 15 Feb 2024 09:01:39 +0100 Subject: [PATCH 05/25] Update codeql.yml with new build-mode --- code-scanning/codeql.yml | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 808449d6b0..d0df66c8ab 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -40,11 +40,12 @@ jobs: strategy: fail-fast: false matrix: - language: [ $detected-codeql-languages ] - # CodeQL supports [ $supported-codeql-languages ] - # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both - # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + $codeql-languages-matrix + # CodeQL supports the following values keywords for 'language': $supported-codeql-languages + # Use 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, + # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. steps: - name: Checkout repository @@ -55,6 +56,7 @@ jobs: uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} # If you wish to specify custom queries, you can do so here or in a config file. # By default, queries listed here will override any specified in a config file. # Prefix the list here with "+" to use these queries and those in the config file. @@ -62,21 +64,20 @@ jobs: # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs # queries: security-extended,security-and-quality - - # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v3 - + # If the analyze step fails for one of the languages you are analyzing with + # "We were unable to automatically build your code", modify the matrix above + # to set the build mode to "manual" for that language. Then modify this step + # to build your code. # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh + - if: ${{ matrix.build-mode == 'manual' }} + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 From 8a973982d129261906540b29fc80512a1fd3ec81 Mon Sep 17 00:00:00 2001 From: Marco Gario Date: Mon, 19 Feb 2024 15:54:06 +0100 Subject: [PATCH 06/25] Update code-scanning/codeql.yml Co-authored-by: Henry Mercer --- code-scanning/codeql.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index d0df66c8ab..00ef183d5b 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -42,6 +42,7 @@ jobs: matrix: $codeql-languages-matrix # CodeQL supports the following values keywords for 'language': $supported-codeql-languages + # Use `c-cpp` to analyze code written in C, C++ or both # Use 'java-kotlin' to analyze code written in Java, Kotlin or both # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, From 4a8c4e08b0b97c465318cc670fc212b94cfcbaba Mon Sep 17 00:00:00 2001 From: Marco Gario Date: Mon, 19 Feb 2024 15:57:02 +0100 Subject: [PATCH 07/25] Update code-scanning/codeql.yml Co-authored-by: Henry Mercer --- code-scanning/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 00ef183d5b..1d23be1ea7 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -71,7 +71,7 @@ jobs: # to build your code. # ℹī¸ Command-line programs to run using the OS shell. # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - if: ${{ matrix.build-mode == 'manual' }} + - if: matrix.build-mode == 'manual' run: | echo 'If you are using a "manual" build mode for one or more of the' \ 'languages you are analyzing, replace this with the commands to build' \ From 03277899f01de35a7544217d1b02c1031bae1102 Mon Sep 17 00:00:00 2001 From: Chad Bentz <1760475+felickz@users.noreply.github.com> Date: Wed, 6 Mar 2024 16:46:46 -0500 Subject: [PATCH 08/25] tfsec latest v0.1.4 (#2318) --- code-scanning/tfsec.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/tfsec.yml b/code-scanning/tfsec.yml index 48ee4d2243..706c8be1a6 100644 --- a/code-scanning/tfsec.yml +++ b/code-scanning/tfsec.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@v3 - name: Run tfsec - uses: aquasecurity/tfsec-sarif-action@9a83b5c3524f825c020e356335855741fd02745f + uses: aquasecurity/tfsec-sarif-action@21ded20e8ca120cd9d3d6ab04ef746477542a608 with: sarif_file: tfsec.sarif From 3fb9f82449706d5e8e6605bf7cb839b690359cdc Mon Sep 17 00:00:00 2001 From: Tim Heuer Date: Tue, 12 Mar 2024 12:08:25 -0700 Subject: [PATCH 09/25] Updating dotnet CI starter workflows (#2333) * Update dotnet.yml Updating versions * Update dotnet-desktop.yml Bumping versions * Update ci/dotnet-desktop.yml Co-authored-by: Alexis Abril --------- Co-authored-by: Alexis Abril --- ci/dotnet-desktop.yml | 8 ++++---- ci/dotnet.yml | 6 +++--- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/ci/dotnet-desktop.yml b/ci/dotnet-desktop.yml index fd82a3962d..ad99b56b9b 100644 --- a/ci/dotnet-desktop.yml +++ b/ci/dotnet-desktop.yml @@ -63,19 +63,19 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 with: fetch-depth: 0 # Install the .NET Core workload - name: Install .NET Core - uses: actions/setup-dotnet@v3 + uses: actions/setup-dotnet@v4 with: - dotnet-version: 6.0.x + dotnet-version: 8.0.x # Add MSBuild to the PATH: https://github.com/microsoft/setup-msbuild - name: Setup MSBuild.exe - uses: microsoft/setup-msbuild@v1.0.2 + uses: microsoft/setup-msbuild@v2 # Execute all unit tests in the solution - name: Execute unit tests diff --git a/ci/dotnet.yml b/ci/dotnet.yml index f11f05069d..b869d6ef84 100644 --- a/ci/dotnet.yml +++ b/ci/dotnet.yml @@ -15,11 +15,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Setup .NET - uses: actions/setup-dotnet@v3 + uses: actions/setup-dotnet@v4 with: - dotnet-version: 6.0.x + dotnet-version: 8.0.x - name: Restore dependencies run: dotnet restore - name: Build From 0f4d22325b4bd42a10be5b295f57866f7c78b2bb Mon Sep 17 00:00:00 2001 From: cclin Date: Mon, 25 Mar 2024 16:05:58 +0800 Subject: [PATCH 10/25] Update astro.yml for yarn based project --- pages/astro.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pages/astro.yml b/pages/astro.yml index 0929af5655..03044be19e 100644 --- a/pages/astro.yml +++ b/pages/astro.yml @@ -42,11 +42,13 @@ jobs: echo "manager=yarn" >> $GITHUB_OUTPUT echo "command=install" >> $GITHUB_OUTPUT echo "runner=yarn" >> $GITHUB_OUTPUT + echo "lockfile=yarn.lock" >> $GITHUB_OUTPUT exit 0 elif [ -f "${{ github.workspace }}/package.json" ]; then echo "manager=npm" >> $GITHUB_OUTPUT echo "command=ci" >> $GITHUB_OUTPUT echo "runner=npx --no-install" >> $GITHUB_OUTPUT + echo "lockfile=package-lock.json" >> $GITHUB_OUTPUT exit 0 else echo "Unable to determine package manager" @@ -57,7 +59,7 @@ jobs: with: node-version: "20" cache: ${{ steps.detect-package-manager.outputs.manager }} - cache-dependency-path: ${{ env.BUILD_PATH }}/package-lock.json + cache-dependency-path: ${{ env.BUILD_PATH }}/${{ steps.detect-package-manager.outputs.lockfile }} - name: Setup Pages id: pages uses: actions/configure-pages@v4 From 61cdce264d9ad8045eee8229857b814e0c0510a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=B9=B4=EA=B8=B0=EC=9E=90=ED=8C=90?= Date: Tue, 26 Mar 2024 08:26:55 +0900 Subject: [PATCH 11/25] Updating nextjs.yml for Next.js 14 Support (#2204) * Update nextjs.yml * Update nextjs.yml --------- Co-authored-by: Alexis Abril --- pages/nextjs.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/pages/nextjs.yml b/pages/nextjs.yml index f91a07d80a..74e57fceb5 100644 --- a/pages/nextjs.yml +++ b/pages/nextjs.yml @@ -73,10 +73,8 @@ jobs: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}- - name: Install dependencies run: ${{ steps.detect-package-manager.outputs.manager }} ${{ steps.detect-package-manager.outputs.command }} - - name: Build with Next.js + - name: Build and Static HTML export with Next.js run: ${{ steps.detect-package-manager.outputs.runner }} next build - - name: Static HTML export with Next.js - run: ${{ steps.detect-package-manager.outputs.runner }} next export - name: Upload artifact uses: actions/upload-pages-artifact@v3 with: From aad92724382fbe4be3a7880224fb9c1cacd3b7b2 Mon Sep 17 00:00:00 2001 From: Marco Gario Date: Tue, 26 Mar 2024 13:18:17 +0100 Subject: [PATCH 12/25] Update codeql.yml Limit matrix information in the job name to language by default --- code-scanning/codeql.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index 1d23be1ea7..dd1406acb0 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -21,7 +21,7 @@ on: jobs: analyze: - name: Analyze + name: Analyze (${{ matrix.language }}) # Runner size impacts CodeQL analysis time. To learn more, please see: # - https://gh.io/recommended-hardware-resources-for-running-codeql # - https://gh.io/supported-runners-and-hardware-resources From fdbad9c74f2ddbd29ef69cedd91184c4552c7360 Mon Sep 17 00:00:00 2001 From: Marco Gario Date: Tue, 26 Mar 2024 13:41:53 +0100 Subject: [PATCH 13/25] Update codeql.yml links to docs --- code-scanning/codeql.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index dd1406acb0..cb883a9bb7 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -47,7 +47,8 @@ jobs: # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. - + # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how + # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository uses: actions/checkout@v4 From 831e9cb8e41cb47e2ffdabda6c3f268a057ffae5 Mon Sep 17 00:00:00 2001 From: Andreas Deininger Date: Wed, 27 Mar 2024 18:51:41 +0100 Subject: [PATCH 14/25] Bump workflow actions of various starter files (#2210) --- code-scanning/detekt.yml | 2 +- code-scanning/endorlabs.yml | 2 +- code-scanning/rust-clippy.yml | 4 ++-- deployments/alibabacloud.yml | 4 ++-- pages/hugo.yml | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/code-scanning/detekt.yml b/code-scanning/detekt.yml index 15aeb45524..502c66e8be 100644 --- a/code-scanning/detekt.yml +++ b/code-scanning/detekt.yml @@ -13,7 +13,7 @@ # 4. Manually, on demand, via the "workflow_dispatch" event # # The workflow should work with no modifications, but you might like to use a -# later version of the Detekt CLI by modifing the $DETEKT_RELEASE_TAG +# later version of the Detekt CLI by modifying the $DETEKT_RELEASE_TAG # environment variable. name: Scan with Detekt diff --git a/code-scanning/endorlabs.yml b/code-scanning/endorlabs.yml index 1ad0e2609b..5633a6bc16 100644 --- a/code-scanning/endorlabs.yml +++ b/code-scanning/endorlabs.yml @@ -24,7 +24,7 @@ jobs: uses: actions/checkout@v3 #### Package Build Instructions ### Use this section to define the build steps used by your software package. - ### Endor Labs builds your software for you where possible but the required build tools must be made availible. + ### Endor Labs builds your software for you where possible but the required build tools must be made available. # - name: Setup Java # uses: actions/setup-java@v3 # with: diff --git a/code-scanning/rust-clippy.yml b/code-scanning/rust-clippy.yml index 90583f342f..4f50c3e203 100644 --- a/code-scanning/rust-clippy.yml +++ b/code-scanning/rust-clippy.yml @@ -28,7 +28,7 @@ jobs: actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@v4 - name: Install Rust toolchain uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1 @@ -52,4 +52,4 @@ jobs: uses: github/codeql-action/upload-sarif@v1 with: sarif_file: rust-clippy-results.sarif - wait-for-processing: true \ No newline at end of file + wait-for-processing: true diff --git a/deployments/alibabacloud.yml b/deployments/alibabacloud.yml index 96d5d3865d..74dd7f63ef 100644 --- a/deployments/alibabacloud.yml +++ b/deployments/alibabacloud.yml @@ -49,7 +49,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v4 # 1.1 Login to ACR - name: Login to ACR with the AccessKey pair @@ -59,7 +59,7 @@ jobs: access-key-id: "${{ secrets.ACCESS_KEY_ID }}" access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}" - # 1.2 Buid and push image to ACR + # 1.2 Build and push image to ACR - name: Build and push image to ACR run: | docker build --tag "$REGISTRY/$NAMESPACE/$IMAGE:$TAG" . diff --git a/pages/hugo.yml b/pages/hugo.yml index 6e40b040b0..1061a74bd7 100644 --- a/pages/hugo.yml +++ b/pages/hugo.yml @@ -31,7 +31,7 @@ jobs: build: runs-on: ubuntu-latest env: - HUGO_VERSION: 0.120.4 + HUGO_VERSION: 0.124.1 steps: - name: Install Hugo CLI run: | From 4620c76b38f478f21a88b354ce6794dcfacba755 Mon Sep 17 00:00:00 2001 From: Spencer Schrock Date: Wed, 27 Mar 2024 13:25:03 -0700 Subject: [PATCH 15/25] update Scorecard Action hashes and version comments (#2348) * update action hashes and version comments ossf/scorecard-action v2.1.2 is old and doesnt work after a Sigstore change. https://blog.sigstore.dev/tuf-root-update/ Signed-off-by: Spencer Schrock * downgrade actions/upload-artifact to node20 version of v3 dependabot will suggest upgrade to v4.3.1 for repos that can upgrade. note: v3.pre.node20 is how dependabot refers to the pinned hash, so use that so it can upgrade the comment Signed-off-by: Spencer Schrock * upgrade github/codeql-action/upload-sarif to v3.24.9 Signed-off-by: Spencer Schrock --------- Signed-off-by: Spencer Schrock Co-authored-by: Alexis Abril --- code-scanning/scorecard.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/code-scanning/scorecard.yml b/code-scanning/scorecard.yml index 19b9b00f29..162c788bbd 100644 --- a/code-scanning/scorecard.yml +++ b/code-scanning/scorecard.yml @@ -32,19 +32,19 @@ jobs: steps: - name: "Checkout code" - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0 + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2 + uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1 with: results_file: results.sarif results_format: sarif # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: # - you want to enable the Branch-Protection check on a *public* repository, or # - you are installing Scorecard on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. # repo_token: ${{ secrets.SCORECARD_TOKEN }} # Public repositories: @@ -59,14 +59,15 @@ jobs: # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF # format to the repository Actions tab. - name: "Upload artifact" - uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 + uses: actions/upload-artifact@97a0fba1372883ab732affbe8f94b823f91727db # v3.pre.node20 with: name: SARIF file path: results.sarif retention-days: 5 - # Upload the results to GitHub's code scanning dashboard. + # Upload the results to GitHub's code scanning dashboard (optional). + # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4 + uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9 with: sarif_file: results.sarif From 4ca845b387fb6f8d1b8ba86e6b2d3b345cd862b7 Mon Sep 17 00:00:00 2001 From: Alexis Abril Date: Fri, 29 Mar 2024 13:23:28 -0700 Subject: [PATCH 16/25] Update CODEOWNERS Simplifying the CODEOWNERS file to allow respective teams the capabilities to manage PRs as responsibilities have been updated recently. In the short term, this will add notifications to folks for each team. --- CODEOWNERS | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/CODEOWNERS b/CODEOWNERS index 2ed2e33dcf..7580ac67a5 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,5 +1,5 @@ +* @actions/advanced-security-code-scanning +* @actions/advanced-security-dependency-graph +* @actions/pages * @actions/actions-workflow-development-reviewers - -/code-scanning/ @actions/advanced-security-code-scanning @actions/actions-workflow-development-reviewers @actions/advanced-security-dependency-graph -/code-scanning/dependency-review.yml @actions/actions-workflow-development-reviewers @actions/advanced-security-dependency-graph -/pages/ @actions/pages @actions/actions-workflow-development-reviewers +* @actions/starter-workflows From 87efe4c91d3d86b0f544d36ceaae0dc8be94f080 Mon Sep 17 00:00:00 2001 From: Alexis Abril Date: Fri, 29 Mar 2024 15:20:42 -0700 Subject: [PATCH 17/25] Update CODEOWNERS Adding @actions/starter-workflows to each category to minimize notification pollution. --- CODEOWNERS | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/CODEOWNERS b/CODEOWNERS index 7580ac67a5..50abb26484 100644 --- a/CODEOWNERS +++ b/CODEOWNERS @@ -1,5 +1,5 @@ -* @actions/advanced-security-code-scanning -* @actions/advanced-security-dependency-graph -* @actions/pages -* @actions/actions-workflow-development-reviewers -* @actions/starter-workflows +* @actions/actions-workflow-development-reviewers @actions/starter-workflows + +/code-scanning/ @actions/advanced-security-code-scanning @actions/actions-workflow-development-reviewers @actions/advanced-security-dependency-graph @actions/starter-workflows +/code-scanning/dependency-review.yml @actions/actions-workflow-development-reviewers @actions/advanced-security-dependency-graph @actions/starter-workflows +/pages/ @actions/pages @actions/actions-workflow-development-reviewers @actions/starter-workflows From c9a0122a593db43660edaf37cf6cae081c2f45d9 Mon Sep 17 00:00:00 2001 From: "James M. Greene" Date: Fri, 29 Mar 2024 19:57:20 -0500 Subject: [PATCH 18/25] Update all Pages workflows to use actions/configure-pages@v5 --- pages/astro.yml | 2 +- pages/gatsby.yml | 2 +- pages/hugo.yml | 2 +- pages/jekyll-gh-pages.yml | 2 +- pages/jekyll.yml | 2 +- pages/mdbook.yml | 2 +- pages/nextjs.yml | 2 +- pages/nuxtjs.yml | 2 +- pages/static.yml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/pages/astro.yml b/pages/astro.yml index 03044be19e..25db103f04 100644 --- a/pages/astro.yml +++ b/pages/astro.yml @@ -62,7 +62,7 @@ jobs: cache-dependency-path: ${{ env.BUILD_PATH }}/${{ steps.detect-package-manager.outputs.lockfile }} - name: Setup Pages id: pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 - name: Install dependencies run: ${{ steps.detect-package-manager.outputs.manager }} ${{ steps.detect-package-manager.outputs.command }} working-directory: ${{ env.BUILD_PATH }} diff --git a/pages/gatsby.yml b/pages/gatsby.yml index c82a2f7aa3..1bcc667f5b 100644 --- a/pages/gatsby.yml +++ b/pages/gatsby.yml @@ -58,7 +58,7 @@ jobs: cache: ${{ steps.detect-package-manager.outputs.manager }} - name: Setup Pages id: pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 with: # Automatically inject pathPrefix in your Gatsby configuration file. # diff --git a/pages/hugo.yml b/pages/hugo.yml index 1061a74bd7..141ad91a5a 100644 --- a/pages/hugo.yml +++ b/pages/hugo.yml @@ -45,7 +45,7 @@ jobs: submodules: recursive - name: Setup Pages id: pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 - name: Install Node.js dependencies run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true" - name: Build with Hugo diff --git a/pages/jekyll-gh-pages.yml b/pages/jekyll-gh-pages.yml index 8d5586c325..2874cc0c98 100644 --- a/pages/jekyll-gh-pages.yml +++ b/pages/jekyll-gh-pages.yml @@ -29,7 +29,7 @@ jobs: - name: Checkout uses: actions/checkout@v4 - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 - name: Build with Jekyll uses: actions/jekyll-build-pages@v1 with: diff --git a/pages/jekyll.yml b/pages/jekyll.yml index 17fec3f9c8..f07bc39085 100644 --- a/pages/jekyll.yml +++ b/pages/jekyll.yml @@ -41,7 +41,7 @@ jobs: cache-version: 0 # Increment this number if you need to re-download cached gems - name: Setup Pages id: pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 - name: Build with Jekyll # Outputs to the './_site' directory by default run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" diff --git a/pages/mdbook.yml b/pages/mdbook.yml index 6ea654d37b..cf79f4e071 100644 --- a/pages/mdbook.yml +++ b/pages/mdbook.yml @@ -39,7 +39,7 @@ jobs: cargo install --version ${MDBOOK_VERSION} mdbook - name: Setup Pages id: pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 - name: Build with mdBook run: mdbook build - name: Upload artifact diff --git a/pages/nextjs.yml b/pages/nextjs.yml index 74e57fceb5..ccde58d30c 100644 --- a/pages/nextjs.yml +++ b/pages/nextjs.yml @@ -54,7 +54,7 @@ jobs: node-version: "20" cache: ${{ steps.detect-package-manager.outputs.manager }} - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 with: # Automatically inject basePath in your Next.js configuration file and disable # server side image optimization (https://nextjs.org/docs/api-reference/next/image#unoptimized). diff --git a/pages/nuxtjs.yml b/pages/nuxtjs.yml index 5ceb0e8d81..25a6862718 100644 --- a/pages/nuxtjs.yml +++ b/pages/nuxtjs.yml @@ -52,7 +52,7 @@ jobs: node-version: "20" cache: ${{ steps.detect-package-manager.outputs.manager }} - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 with: # Automatically inject router.base in your Nuxt configuration file and set # target to static (https://nuxtjs.org/docs/configuration-glossary/configuration-target/). diff --git a/pages/static.yml b/pages/static.yml index 819974a2c2..5640380712 100644 --- a/pages/static.yml +++ b/pages/static.yml @@ -32,7 +32,7 @@ jobs: - name: Checkout uses: actions/checkout@v4 - name: Setup Pages - uses: actions/configure-pages@v4 + uses: actions/configure-pages@v5 - name: Upload artifact uses: actions/upload-pages-artifact@v3 with: From e4837fa7681a5ff12fe8500675c47c7f6a296f98 Mon Sep 17 00:00:00 2001 From: "James M. Greene" Date: Fri, 29 Mar 2024 20:19:30 -0500 Subject: [PATCH 19/25] Improve step name for Next.js build --- pages/nextjs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pages/nextjs.yml b/pages/nextjs.yml index ccde58d30c..e2c9ab62a2 100644 --- a/pages/nextjs.yml +++ b/pages/nextjs.yml @@ -73,7 +73,7 @@ jobs: ${{ runner.os }}-nextjs-${{ hashFiles('**/package-lock.json', '**/yarn.lock') }}- - name: Install dependencies run: ${{ steps.detect-package-manager.outputs.manager }} ${{ steps.detect-package-manager.outputs.command }} - - name: Build and Static HTML export with Next.js + - name: Build with Next.js run: ${{ steps.detect-package-manager.outputs.runner }} next build - name: Upload artifact uses: actions/upload-pages-artifact@v3 From efd31e5f0f3f40497cbbd7d3991ddac4da4037ca Mon Sep 17 00:00:00 2001 From: SOOS-GSteen Date: Mon, 1 Apr 2024 16:11:05 -0400 Subject: [PATCH 20/25] update soos dash action commit hash / sarif action version / logo (#2317) * Update soos-dast-scan.yml * Update soos-dast-scan.yml * Update soos.svg * Update code-scanning/soos-dast-scan.yml Co-authored-by: Alexis Abril --------- Co-authored-by: Alexis Abril --- code-scanning/soos-dast-scan.yml | 6 +++--- icons/soos.svg | 18 +----------------- 2 files changed, 4 insertions(+), 20 deletions(-) diff --git a/code-scanning/soos-dast-scan.yml b/code-scanning/soos-dast-scan.yml index 335aa03dae..b3e470e98f 100644 --- a/code-scanning/soos-dast-scan.yml +++ b/code-scanning/soos-dast-scan.yml @@ -36,7 +36,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run SOOS DAST Analysis - uses: soos-io/soos-dast-github-action@d0ee0d8feb02c1881e6a1d785bf2078662631150 + uses: soos-io/soos-dast-github-action@a7f2cb2dfd143cb3224712d902ca0a1da0198ea9 with: client_id: ${{ secrets.SOOS_CLIENT_ID }} api_key: ${{ secrets.SOOS_API_KEY }} @@ -45,6 +45,6 @@ jobs: target_url: "https://www.example.com/" output_format: "sarif" - name: Upload SOOS DAST SARIF Report - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: - sarif_file: results.sarif \ No newline at end of file + sarif_file: results.sarif diff --git a/icons/soos.svg b/icons/soos.svg index 17a31fcb08..7480560df9 100644 --- a/icons/soos.svg +++ b/icons/soos.svg @@ -1,17 +1 @@ - - - - - - - - - - - + \ No newline at end of file From b53d05e4b0dde7cdaeda60476acfcaaa1713f8cc Mon Sep 17 00:00:00 2001 From: Charly Garcia <155784995+cgarciagarcia@users.noreply.github.com> Date: Mon, 1 Apr 2024 17:12:02 -0300 Subject: [PATCH 21/25] ci: use artisan command to run test, because this ci/laravel.yml does not work properly in laravel when uses Pest instead of PHPUnit (#2284) Co-authored-by: Alexis Abril --- ci/laravel.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/laravel.yml b/ci/laravel.yml index e778d7b313..fc30f21321 100644 --- a/ci/laravel.yml +++ b/ci/laravel.yml @@ -28,8 +28,8 @@ jobs: run: | mkdir -p database touch database/database.sqlite - - name: Execute tests (Unit and Feature tests) via PHPUnit + - name: Execute tests (Unit and Feature tests) via PHPUnit/Pest env: DB_CONNECTION: sqlite DB_DATABASE: database/database.sqlite - run: vendor/bin/phpunit + run: php artisan test From 31a3e00dab4440b64f47b6b9d92f8d330e1b6f00 Mon Sep 17 00:00:00 2001 From: Issy Long Date: Wed, 3 Apr 2024 10:23:11 +0100 Subject: [PATCH 22/25] codeql: Clarify that hosted larger runners only exist on GHEC - Part of https://github.com/github/code-scanning/issues/13748. --- code-scanning/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index cb883a9bb7..d24240d0d4 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -25,8 +25,8 @@ jobs: # Runner size impacts CodeQL analysis time. To learn more, please see: # - https://gh.io/recommended-hardware-resources-for-running-codeql # - https://gh.io/supported-runners-and-hardware-resources - # - https://gh.io/using-larger-runners - # Consider using larger runners for possible analysis time improvements. + # - https://gh.io/using-larger-runners (GitHub.com only) + # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} permissions: From ca5bcdc6930fe44fae60c9e0a60f5c1f56b2d449 Mon Sep 17 00:00:00 2001 From: Rex P <106129829+another-rex@users.noreply.github.com> Date: Wed, 10 Apr 2024 13:21:33 +1000 Subject: [PATCH 23/25] Add OSV-Scanner code scanning workflow (#2350) * Add OSV-Scanner code scanning workflow * Update code-scanning/osv-scanner.yml Co-authored-by: Alexis Abril --------- Co-authored-by: Alexis Abril --- code-scanning/osv-scanner.yml | 48 +++++++++++++++++++ .../properties/osv-scanner.properties.json | 7 +++ icons/osv.svg | 29 +++++++++++ 3 files changed, 84 insertions(+) create mode 100644 code-scanning/osv-scanner.yml create mode 100644 code-scanning/properties/osv-scanner.properties.json create mode 100644 icons/osv.svg diff --git a/code-scanning/osv-scanner.yml b/code-scanning/osv-scanner.yml new file mode 100644 index 0000000000..2aa7150659 --- /dev/null +++ b/code-scanning/osv-scanner.yml @@ -0,0 +1,48 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities, +# in addition to a PR check which fails if new vulnerabilities are introduced. +# +# For more examples and options, including how to ignore specific vulnerabilities, +# see https://google.github.io/osv-scanner/github-action/ + +name: OSV-Scanner + +on: + pull_request: + branches: [ $default-branch, $protected-branches ] + merge_group: + branches: [ $default-branch, $protected-branches ] + schedule: + - cron: $cron-weekly + push: + branches: [ $default-branch, $protected-branches ] + +permissions: + # Require writing security events to upload SARIF file to security tab + security-events: write + # Read commit contents + contents: read + +jobs: + scan-scheduled: + if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@1f1242919d8a60496dd1874b24b62b2370ed4c78" # v1.7.1 + with: + # Example of specifying custom arguments + scan-args: |- + -r + --skip-git + ./ + scan-pr: + if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@1f1242919d8a60496dd1874b24b62b2370ed4c78" # v1.7.1 + with: + # Example of specifying custom arguments + scan-args: |- + -r + --skip-git + ./ diff --git a/code-scanning/properties/osv-scanner.properties.json b/code-scanning/properties/osv-scanner.properties.json new file mode 100644 index 0000000000..2ea1d36d03 --- /dev/null +++ b/code-scanning/properties/osv-scanner.properties.json @@ -0,0 +1,7 @@ +{ + "name": "OSV Scanner", + "creator": "Google", + "description": "Vulnerability scanner for your dependencies using data provided by https://osv.dev", + "iconName": "osv", + "categories": ["Code Scanning", "JavaScript", "Python", "Java", "PHP", "C#", "R", "Ruby", "Rust", "Swift", "Go", "TypeScript"] +} diff --git a/icons/osv.svg b/icons/osv.svg new file mode 100644 index 0000000000..c01aeee446 --- /dev/null +++ b/icons/osv.svg @@ -0,0 +1,29 @@ + + + + + + + + + + + + From a3194f5b4757a7bfb2324b17ccf11e28df2bc4f9 Mon Sep 17 00:00:00 2001 From: Marco Gario Date: Thu, 11 Apr 2024 09:39:30 +0200 Subject: [PATCH 24/25] Update CodeQL workflow to use packages:read permission. Co-authored-by: Anders Starcke Henriksen --- code-scanning/codeql.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/code-scanning/codeql.yml b/code-scanning/codeql.yml index d24240d0d4..6fdadb163d 100644 --- a/code-scanning/codeql.yml +++ b/code-scanning/codeql.yml @@ -33,6 +33,9 @@ jobs: # required for all workflows security-events: write + # required to fetch internal or private CodeQL packs + packages: read + # only required for workflows in private repositories actions: read contents: read From ac9c407320899c9ddcb5054890deec998e9a20bb Mon Sep 17 00:00:00 2001 From: mponaws <157431286+mponaws@users.noreply.github.com> Date: Thu, 18 Apr 2024 12:39:17 -0700 Subject: [PATCH 25/25] Add starter-workflows for Policy Validator (#2375) * Add starter-workflows for Policy Validator * Add starter-workflows for Policy Validator * Add starter-workflows for Policy Validator, removed references to GitHub secrets & S3 to keep it simple --- code-scanning/policy-validator-cfn.yaml | 84 ++++++++++++++++++ code-scanning/policy-validator-tf.yaml | 87 +++++++++++++++++++ .../policy-validator-cfn.properties.json | 7 ++ .../policy-validator-tf.properties.json | 7 ++ 4 files changed, 185 insertions(+) create mode 100644 code-scanning/policy-validator-cfn.yaml create mode 100644 code-scanning/policy-validator-tf.yaml create mode 100644 code-scanning/properties/policy-validator-cfn.properties.json create mode 100644 code-scanning/properties/policy-validator-tf.properties.json diff --git a/code-scanning/policy-validator-cfn.yaml b/code-scanning/policy-validator-cfn.yaml new file mode 100644 index 0000000000..b2cd163a9f --- /dev/null +++ b/code-scanning/policy-validator-cfn.yaml @@ -0,0 +1,84 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow will validate the IAM policies in the CloudFormation (CFN) templates with using the standard and custom checks in AWS IAM Access Analyzer +# To use this workflow, you will need to complete the following set up steps before start using it: +# 1. Configure an AWS IAM role to use the Access Analyzer's ValidatePolicy, CheckNoNewAccess and CheckAccessNotGranted. This IAM role must be configured to call from the GitHub Actions, use the following [doc](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/) for steps. In the below workflow, ARN of such role is stored in the GitHub secrets with name `POLICY_VALIDATOR_ROLE` +# 2. If you're using CHECK_NO_NEW_ACCESS policy-check-type, you need to create a reference policy. Use the guide [here](https://github.com/aws-samples/iam-access-analyzer-custom-policy-check-samples?tab=readme-ov-file#how-do-i-write-my-own-reference-policies) and store it your GitHub repo. +# 3. If you're using the CHECK_ACCESS_NOT_GRANTED policy-check-type, identify the list of critical actions that shouldn't be granted access by the policies in the given CFN templates. +# 4. Start using the GitHub actions by generating the GitHub events matching the defined criteria in your workflow. +name: Validate AWS IAM policies in CloudFormation templates using Policy Validator +on: + push: + branches: [$default-branch, $protected-branches] + pull_request: + # The branches below must be a subset of the branches above + branches: [$default-branch] +env: + AWS_ROLE: MY_ROLE # set this with the role ARN which has permissions to invoke access-analyzer:ValidatePolicy,access-analyzer:CheckNoNewAccess, access-analyzer:CheckAccessNotGranted and can be used in GitHub actions + REGION: MY_AWS_REGION # set this to your preferred AWS region where you plan to deploy your policies, e.g. us-west-1 + TEMPLATE_PATH: FILE_PATH_TO_CFN_TEMPLATE # set to the file path to the CloudFormation template. + ACTIONS: MY_LIST_OF_ACTIONS # set to pass list of actions in the format action1, action2,.. This is required if you are using `CHECK_ACCESS_NOT_GRANTED` policy-check-type. + REFERENCE_POLICY: REFERENCE_POLICY # set to pass a JSON formatted file that specifies the path to the reference policy that is used for a permissions comparison. For example, if you stored such path in a GitHub secret with name REFERENCE_IDENTITY_POLICY , you can pass ${{ secrets.REFERENCE_IDENTITY_POLICY }}. If not you have the reference policy in the repository, you can directly pass it's file path. This is required if you are using `CHECK_NO_NEW_ACCESS_CHECK` policy-check-type. + REFERENCE_POLICY_TYPE: TYPE_OF_REFERENCE_POLICY # set to pass the policy type associated with the IAM policy under analysis and the reference policy. This is required if you are using `CHECK_NO_NEW_ACCESS_CHECK` policy-check-type. +jobs: + policy-validator: + runs-on: ubuntu-latest # Virtual machine to run the workflow (configurable) + # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#updating-your-github-actions-workflow + # https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ + permissions: + id-token: write # This is required for requesting the JWT + contents: read # This is required for actions/checkout + name: Policy Validator checks for AWS IAM policies + steps: + # checkout the repo for workflow to access the contents + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 + # Configure AWS Credentials. More configuration details here - https://github.com/aws-actions/configure-aws-credentials + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + with: + role-to-assume: ${{ env.AWS_ROLE }} + aws-region: ${{ env.REGION }} + # Run the VALIDATE_POLICY check. More configuration details here - https://github.com/aws-actions/cloudformation-aws-iam-policy-validator + - name: Run AWS AccessAnalyzer ValidatePolicy check + id: run-aws-validate-policy + uses: aws-actions/cloudformation-aws-iam-policy-validator@10479bdc0c8322ffb6f5eaa75d096195f97b798a #v1.0.0 + with: + policy-check-type: "VALIDATE_POLICY" + template-path: ${{ env.TEMPLATE_PATH}} + region: ${{ env.REGION }} + # Print result from VALIDATE_POLICY check + - name: Print the result for ValidatePolicy check + if: success() || failure() + run: echo "${{ steps.run-aws-validate-policy.outputs.result }}" + # Run the CHECK_ACCESS_NOT_GRANTED check. More configuration details here - https://github.com/aws-actions/cloudformation-aws-iam-policy-validator + - name: Run AWS AccessAnalyzer CheckAccessNotGranted check + id: run-aws-check-access-not-granted + uses: aws-actions/cloudformation-aws-iam-policy-validator@10479bdc0c8322ffb6f5eaa75d096195f97b798a #v1.0.0 + with: + policy-check-type: "CHECK_ACCESS_NOT_GRANTED" + template-path: ${{ env.TEMPLATE_PATH}} + actions: ${{ env.ACTIONS }} + region: ${{ env.REGION }} + # Print result from CHECK_ACCESS_NOT_GRANTED check + - name: Print the result for CheckAccessNotGranted check + if: success() || failure() + run: echo "${{ steps.run-aws-check-access-not-granted.outputs.result }}" + # Run the CHECK_NO_NEW_ACCESS check. More configuration details here - https://github.com/aws-actions/cloudformation-aws-iam-policy-validator + # reference-policy is stored in GitHub secrets + - name: Run AWS AccessAnalyzer CheckNoNewAccess check + id: run-aws-check-no-new-access + uses: aws-actions/cloudformation-aws-iam-policy-validator@10479bdc0c8322ffb6f5eaa75d096195f97b798a #v1.0.0 + with: + policy-check-type: "CHECK_NO_NEW_ACCESS" + template-path: ${{ env.TEMPLATE_PATH}} + reference-policy: ${{ env.REFERENCE }} + reference-policy-type: ${{ env.REFERENCE_POLICY_TYPE }} + region: ${{env.REGION }} + # Print result from CHECK_NO_NEW_ACCESS check + - name: Print the result for CheckNoNewAccess check + if: success() || failure() + run: echo "${{ steps.run-aws-check-no-new-access.outputs.result }}" diff --git a/code-scanning/policy-validator-tf.yaml b/code-scanning/policy-validator-tf.yaml new file mode 100644 index 0000000000..1ca77b5f95 --- /dev/null +++ b/code-scanning/policy-validator-tf.yaml @@ -0,0 +1,87 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow will validate the IAM policies in the terraform (TF) templates with using the standard and custom checks in AWS IAM Access Analyzer +# To use this workflow, you will need to complete the following set up steps before start using it: +# 1. Configure an AWS IAM role to use the Access Analyzer's ValidatePolicy, CheckNoNewAccess and CheckAccessNotGranted. This IAM role must be configured to call from the GitHub Actions, use the following [doc](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/) for steps. +# 2. If you're using CHECK_NO_NEW_ACCESS policy-check-type, you need to create a reference policy. Use the guide [here](https://github.com/aws-samples/iam-access-analyzer-custom-policy-check-samples?tab=readme-ov-file#how-do-i-write-my-own-reference-policies) and store it your GitHub repo. +# 3. If you're using the CHECK_ACCESS_NOT_GRANTED policy-check-type, identify the list of critical actions that shouldn't be granted access by the policies in the TF templates. +# 4. Start using the GitHub actions by generating the GitHub events matching the defined criteria in your workflow. + +name: Validate AWS IAM policies in Terraform templates using Policy Validator +on: + push: + branches: [$default-branch, $protected-branches] + pull_request: + # The branches below must be a subset of the branches above + branches: [$default-branch] +env: + AWS_ROLE: MY_ROLE # set this with the role ARN which has permissions to invoke access-analyzer:ValidatePolicy,access-analyzer:CheckNoNewAccess, access-analyzer:CheckAccessNotGranted and can be used in GitHub actions + REGION: MY_AWS_REGION # set this to your preferred AWS region where you plan to deploy your policies, e.g. us-west-1 + TEMPLATE_PATH: FILE_PATH_TO_THE_TF_PLAN # set this to the file path to the terraform plan in JSON + ACTIONS: MY_LIST_OF_ACTIONS # set to pass list of actions in the format action1, action2,.. This is required if you are using `CHECK_ACCESS_NOT_GRANTED` policy-check-type. + REFERENCE_POLICY: REFERENCE_POLICY # set to pass a JSON formatted file that specifies the path to the reference policy that is used for a permissions comparison. For example, if you stored such path in a GitHub secret with name REFERENCE_IDENTITY_POLICY , you can pass ${{ secrets.REFERENCE_IDENTITY_POLICY }}. If not you have the reference policy in the repository, you can directly pass it's path. This is required if you are using `CHECK_NO_NEW_ACCESS_CHECK` policy-check-type. + REFERENCE_POLICY_TYPE: TYPE_OF_REFERENCE_POLICY # set to pass the policy type associated with the IAM policy under analysis and the reference policy. This is required if you are using `CHECK_NO_NEW_ACCESS_CHECK` policy-check-type. + +jobs: + policy-validator: + runs-on: ubuntu-latest # Virtual machine to run the workflow (configurable) + #https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services#updating-your-github-actions-workflow + #https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ + permissions: + id-token: write # This is required for requesting the JWT + contents: read # This is required for actions/checkout + # https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners + name: Policy Validator checks for AWS IAM policies + steps: + # checkout the repo for workflow to access the contents + - name: Checkout + uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 + # Configure AWS Credentials. More configuration details here- https://github.com/aws-actions/configure-aws-credentials + - name: Configure AWS Credentials + uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 + with: + role-to-assume: ${{ env.AWS_ROLE }} + aws-region: ${{ env.REGION }} + # Run the VALIDATE_POLICY check. More configuration details here - https://github.com/aws-actions/terraform-aws-iam-policy-validator + - name: Run AWS AccessAnalyzer ValidatePolicy check + id: run-aws-validate-policy + uses: aws-actions/terraform-aws-iam-policy-validator@3e527234ccf8ca494450942c4a91d54b291b013e #v1.0.0 + with: + policy-check-type: "VALIDATE_POLICY" + template-path: ${{ env.TEMPLATE_PATH }} + region: ${{ env.REGION }} + # Print result from VALIDATE_POLICY check + - name: Print the result for ValidatePolicy check + if: success() || failure() + run: echo "${{ steps.run-aws-validate-policy.outputs.result }}" + # Run the CHECK_ACCESS_NOT_GRANTED check. More configuration details here - https://github.com/aws-actions/terraform-aws-iam-policy-validator + - name: Run AWS AccessAnalyzer CheckAccessNotGranted check + id: run-aws-check-access-not-granted + uses: aws-actions/terraform-aws-iam-policy-validator@3e527234ccf8ca494450942c4a91d54b291b013e #v1.0.0 + with: + policy-check-type: "CHECK_ACCESS_NOT_GRANTED" + template-path: ${{ env.TEMPLATE_PATH }} + actions: ${{ env.ACTIONS }} + region: ${{ env.REGION }} + # Print result from CHECK_ACCESS_NOT_GRANTED check + - name: Print the result for CheckAccessNotGranted check + if: success() || failure() + run: echo "${{ steps.run-aws-check-access-not-granted.outputs.result }}" + # Run the CHECK_NO_NEW_ACCESS check. More configuration details here - https://github.com/aws-actions/terraform-aws-iam-policy-validator + # reference-policy is stored in GitHub secrets + - name: Run AWS AccessAnalyzer CheckNoNewAccess check + id: run-aws-check-no-new-access + uses: aws-actions/terraform-aws-iam-policy-validator@3e527234ccf8ca494450942c4a91d54b291b013e #v1.0.0 + with: + policy-check-type: "CHECK_NO_NEW_ACCESS" + template-path: ${{ env.TEMPLATE_PATH }} + reference-policy: ${{ env.REFERENCE_POLICY }} + reference-policy-type: ${{ env.REFERENCE_POLICY_TYPE }} + region: ${{ env.REGION }} + # Print result from CHECK_NO_NEW_ACCESS check + - name: Print the result CheckNoNewAccess check + if: success() || failure() + run: echo "${{ steps.run-aws-check-no-new-access.outputs.result }}" diff --git a/code-scanning/properties/policy-validator-cfn.properties.json b/code-scanning/properties/policy-validator-cfn.properties.json new file mode 100644 index 0000000000..496b36856c --- /dev/null +++ b/code-scanning/properties/policy-validator-cfn.properties.json @@ -0,0 +1,7 @@ +{ + "name": "Policy Validator for CloudFormation", + "creator": "Amazon Web Services", + "description": "Validate AWS IAM Policies in CloudFormation Templates powered IAM Access Analyzer", + "iconName": "aws", + "categories": ["Code Scanning", "AWS", "Python"] +} diff --git a/code-scanning/properties/policy-validator-tf.properties.json b/code-scanning/properties/policy-validator-tf.properties.json new file mode 100644 index 0000000000..f683f49c1e --- /dev/null +++ b/code-scanning/properties/policy-validator-tf.properties.json @@ -0,0 +1,7 @@ +{ + "name": "Policy Validator for Terraform", + "creator": "Amazon Web Services", + "description": "Validate AWS IAM Policies in Terraform Templates powered IAM Access Analyzer", + "iconName": "aws", + "categories": ["Code Scanning", "AWS", "Python"] +}