From 6ec14e8b2407dff61ca8338190b7a39712520aa2 Mon Sep 17 00:00:00 2001 From: Ethan Soergel Date: Mon, 30 Sep 2024 13:19:40 -0400 Subject: [PATCH 1/6] Add default CodeQL workflow file --- .github/workflows/codeql.yml | 94 ++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000000..fbbb74ef49 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,94 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL Advanced" + +on: + push: + branches: [ "master" ] + pull_request: + branches: [ "master" ] + schedule: + - cron: '20 15 * * 5' + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners (GitHub.com only) + # Consider using larger runners or machines with greater resources for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: python + build-mode: none + - language: ruby + build-mode: none + # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' + # Use `c-cpp` to analyze code written in C, C++ or both + # Use 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, + # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. + # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how + # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + # If the analyze step fails for one of the languages you are analyzing with + # "We were unable to automatically build your code", modify the matrix above + # to set the build mode to "manual" for that language. Then modify this step + # to build your code. + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + - if: matrix.build-mode == 'manual' + shell: bash + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" From 82fa8484eb441a6646de4c8384fd2d15ec9a0610 Mon Sep 17 00:00:00 2001 From: Ethan Soergel Date: Mon, 30 Sep 2024 13:41:16 -0400 Subject: [PATCH 2/6] Disable CodeQL on PRs --- .github/workflows/codeql.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fbbb74ef49..5529ba0b18 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -12,10 +12,10 @@ name: "CodeQL Advanced" on: - push: - branches: [ "master" ] - pull_request: - branches: [ "master" ] + # push: + # branches: [ "master" ] + # pull_request: + # branches: [ "master" ] schedule: - cron: '20 15 * * 5' From b70edcad73da066deb6288352bcae406a002c14f Mon Sep 17 00:00:00 2001 From: Ethan Soergel Date: Wed, 2 Oct 2024 16:43:29 -0400 Subject: [PATCH 3/6] Add trivy workflow to `commcare-cloud` For static analysis of terraform code --- .github/workflows/trivy.yml | 44 +++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 .github/workflows/trivy.yml diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 0000000000..8895c3e2e8 --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,44 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: trivy + +on: + push: + branches: [ "master" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "master" ] + schedule: + - cron: '35 6 * * 6' + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + name: Build + runs-on: "ubuntu-20.04" + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run Trivy vulnerability scanner in repo mode + uses: aquasecurity/trivy-action@0.20.0 + with: + scan-type: 'fs' + ignore-unfixed: true + format: 'sarif' + output: 'trivy-results.sarif' + severity: 'CRITICAL' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: 'trivy-results.sarif' From 329485642ed2a260acdb0a360eec8146de4dd5ba Mon Sep 17 00:00:00 2001 From: Ethan Soergel Date: Wed, 2 Oct 2024 17:03:22 -0400 Subject: [PATCH 4/6] Run trivy only weekly --- .github/workflows/codeql.yml | 2 +- .github/workflows/trivy.yml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5529ba0b18..354a296fc4 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -17,7 +17,7 @@ on: # pull_request: # branches: [ "master" ] schedule: - - cron: '20 15 * * 5' + - cron: '35 6 * * 6' jobs: analyze: diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 8895c3e2e8..d7ae73e963 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -6,11 +6,11 @@ name: trivy on: - push: - branches: [ "master" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "master" ] + # push: + # branches: [ "master" ] + # pull_request: + # # The branches below must be a subset of the branches above + # branches: [ "master" ] schedule: - cron: '35 6 * * 6' From ce8ee1139ab50230e563f1fa63013fc6e2a2ebac Mon Sep 17 00:00:00 2001 From: Ethan Soergel Date: Wed, 2 Oct 2024 17:30:52 -0400 Subject: [PATCH 5/6] Add trivy config scanner --- .github/workflows/trivy.yml | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index d7ae73e963..c4f3da1bd8 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -8,9 +8,9 @@ name: trivy on: # push: # branches: [ "master" ] - # pull_request: - # # The branches below must be a subset of the branches above - # branches: [ "master" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "master" ] schedule: - cron: '35 6 * * 6' @@ -18,12 +18,12 @@ permissions: contents: read jobs: - build: + analyze: permissions: contents: read # for actions/checkout to fetch code security-events: write # for github/codeql-action/upload-sarif to upload SARIF results actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status - name: Build + name: Analyze runs-on: "ubuntu-20.04" steps: - name: Checkout code @@ -35,10 +35,28 @@ jobs: scan-type: 'fs' ignore-unfixed: true format: 'sarif' - output: 'trivy-results.sarif' + output: 'trivy-fs-results.sarif' severity: 'CRITICAL' - - name: Upload Trivy scan results to GitHub Security tab + - name: Upload Trivy filesystem scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: 'trivy-fs-results.sarif' + category: "trivy-filesystem" + + - name: Run Trivy vulnerability scanner in IaC mode + uses: aquasecurity/trivy-action@0.20.0 + with: + scan-type: 'config' + hide-progress: true + format: 'sarif' + output: 'trivy-config-results.sarif' + exit-code: '0' + ignore-unfixed: true + severity: 'CRITICAL,HIGH' + + - name: Upload Trivy config scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v3 with: - sarif_file: 'trivy-results.sarif' + sarif_file: 'trivy-config-results.sarif' + category: "trivy-config" From d2b958d9e3e0f47ddb46be5e4c46beff62979fd9 Mon Sep 17 00:00:00 2001 From: Ethan Soergel Date: Wed, 2 Oct 2024 17:55:14 -0400 Subject: [PATCH 6/6] Turn off PR runs now that I've verified the workflow --- .github/workflows/trivy.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index c4f3da1bd8..5f28fb48ea 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -8,9 +8,9 @@ name: trivy on: # push: # branches: [ "master" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "master" ] + # pull_request: + # # The branches below must be a subset of the branches above + # branches: [ "master" ] schedule: - cron: '35 6 * * 6'