diff --git a/.github/workflows/security-gate.yml b/.github/workflows/security-gate.yml index e616781..4c53d9d 100644 --- a/.github/workflows/security-gate.yml +++ b/.github/workflows/security-gate.yml @@ -39,4 +39,6 @@ jobs: -h "$MAX_HIGH" \ -m "$MAX_MEDIUM" \ -l "$MAX_LOW" \ - --dependency-alerts \ No newline at end of file + --dependency-alerts + --secrets-alerts + --code-alerts \ No newline at end of file diff --git a/lib/SecurityGate/Engine/Code.pm b/lib/SecurityGate/Engine/Code.pm index 706019d..e964efb 100644 --- a/lib/SecurityGate/Engine/Code.pm +++ b/lib/SecurityGate/Engine/Code.pm @@ -1,69 +1,75 @@ -package SecurityGate::Engine::Code; +package SecurityGate::Engine::Code { + use strict; + use warnings; + use Mojo::UserAgent; + use Mojo::JSON; -use strict; -use warnings; -use Mojo::UserAgent; -use Mojo::JSON; + sub new { + my ($class, $token, $repository, $severity_limits) = @_; -sub new { - my ($class, $token, $repository, $severity_limits) = @_; + my $alerts_endpoint = "https://api.github.com/repos/$repository/code-scanning/alerts"; + my $analyses_endpoint = "https://api.github.com/repos/$repository/code-scanning/analyses"; + + my $userAgent = Mojo::UserAgent -> new(); + my $alerts_request = $userAgent -> get($alerts_endpoint, {Authorization => "Bearer $token"}) -> result(); - my $alerts_endpoint = "https://api.github.com/repos/$repository/code-scanning/alerts"; - my $analyses_endpoint = "https://api.github.com/repos/$repository/code-scanning/analyses"; - - my $userAgent = Mojo::UserAgent -> new(); + if ($alerts_request -> code() == 200) { + my $alerts_data = $alerts_request -> json(); + my $open_alerts = 0; + my %severity_counts = map {$_ => 0} keys %$severity_limits; - my $alerts_request = $userAgent -> get($alerts_endpoint, {Authorization => "Bearer $token"}) -> result(); + foreach my $alert (@$alerts_data) { + if ($alert -> {state} eq "open") { + $open_alerts++; + + my $severity = $alert -> {rule} -> {severity}; + $severity_counts{$severity}++ if exists $severity_counts{$severity}; + } + } - if ($alerts_request -> code() == 200) { - my $alerts_data = $alerts_request -> json(); - my $open_alerts = 0; - my %severity_counts = map {$_ => 0} keys %$severity_limits; + print "[!] Total of open code scanning alerts: $open_alerts\n"; + + foreach my $severity (keys %severity_counts) { + print "[-] $severity: $severity_counts{$severity}\n"; + } - foreach my $alert (@$alerts_data) { - if ($alert -> {state} eq "open") { - $open_alerts++; - my $severity = $alert -> {rule} -> {severity}; - $severity_counts{$severity}++ if exists $severity_counts{$severity}; - } - } - - print "[!] Total of open code scanning alerts: $open_alerts\n"; - foreach my $severity (keys %severity_counts) { - print "[-] $severity: $severity_counts{$severity}\n"; - } + my $threshold_exceeded = 0; + + foreach my $severity (keys %severity_counts) { + if ($severity_counts{$severity} > $severity_limits -> {$severity}) { + print "[+] More than $severity_limits -> {$severity} $severity code scanning alerts found.\n"; + + $threshold_exceeded = 1; + } + } - my $threshold_exceeded = 0; - foreach my $severity (keys %severity_counts) { - if ($severity_counts{$severity} > $severity_limits -> {$severity}) { - print "[+] More than $severity_limits -> {$severity} $severity code scanning alerts found.\n"; - $threshold_exceeded = 1; + if ($threshold_exceeded) { + return 1; + } } - } - if ($threshold_exceeded) { - return 1; - } - } - - else { - print "Error: Unable to fetch code scanning alerts. HTTP status code: " . $alerts_request -> code() . "\n"; - return 1; - } + else { + print "Error: Unable to fetch code scanning alerts. HTTP status code: " . $alerts_request -> code() . "\n"; + + return 1; + } - my $analyses_request = $userAgent -> get($analyses_endpoint, {Authorization => "Bearer $token"}) -> result(); + my $analyses_request = $userAgent -> get($analyses_endpoint, {Authorization => "Bearer $token"}) -> result(); - if ($analyses_request -> code() == 200) { - my $analyses_data = $analyses_request -> json(); - print "[!] Total of code scanning analyses found: " . scalar(@$analyses_data) . "\n"; - } + if ($analyses_request -> code() == 200) { + my $analyses_data = $analyses_request -> json(); + + print "[!] Total of code scanning analyses found: " . scalar(@$analyses_data) . "\n"; + } - else { - print "Error: Unable to fetch code scanning analyses. HTTP status code: " . $analyses_request -> code() . "\n"; - return 1; - } + else { + print "Error: Unable to fetch code scanning analyses. HTTP status code: " . $analyses_request -> code() . "\n"; + + return 1; + } - return 0; + return 0; + } } -1; +1; \ No newline at end of file diff --git a/lib/SecurityGate/Engine/Secrets.pm b/lib/SecurityGate/Engine/Secrets.pm index dd3fe10..77703ab 100644 --- a/lib/SecurityGate/Engine/Secrets.pm +++ b/lib/SecurityGate/Engine/Secrets.pm @@ -1,62 +1,65 @@ -package SecurityGate::Engine::Secrets; - -use strict; -use warnings; -use Mojo::UserAgent; -use Mojo::JSON; - -sub new { - my ($class, $token, $repository) = @_; - - my $endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts"; - my $userAgent = Mojo::UserAgent -> new(); - my $request = $userAgent -> get($endpoint, {Authorization => "Bearer $token"}) -> result(); - - if ($request -> code() == 200) { - my $data = $request -> json(); - my $open_alerts = 0; - my @alert_details; - - foreach my $alert (@$data) { - if ($alert -> {state} eq "open") { - $open_alerts++; - - my $locations_endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts/$alert -> {number}/locations"; - my $locations_request = $userAgent -> get($locations_endpoint, {Authorization => "Bearer $token"}) -> result(); - - if ($locations_request -> code() == 200) { - my $locations = $locations_request -> json(); - push @alert_details, { - alert_number => $alert -> {number}, - locations => $locations, - }; - } - } - } - - if ($open_alerts > 0) { - print "[!] Total of open secret scanning alerts: $open_alerts\n"; - foreach my $detail (@alert_details) { - print "[-] Alert $detail -> {alert_number} found in the following locations:\n"; - foreach my $location (@{$detail -> {locations}}) { - print " File: $location -> {path}, Start line: $location -> {start_line}\n"; +package SecurityGate::Engine::Secrets { + use strict; + use warnings; + use Mojo::UserAgent; + use Mojo::JSON; + + sub new { + my ($class, $token, $repository) = @_; + + my $endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts"; + my $userAgent = Mojo::UserAgent -> new(); + my $request = $userAgent -> get($endpoint, {Authorization => "Bearer $token"}) -> result(); + + if ($request -> code() == 200) { + my $data = $request -> json(); + my $open_alerts = 0; + my @alert_details; + + foreach my $alert (@$data) { + if ($alert -> {state} eq "open") { + $open_alerts++; + + my $locations_endpoint = "https://api.github.com/repos/$repository/secret-scanning/alerts/$alert -> {number}/locations"; + my $locations_request = $userAgent -> get($locations_endpoint, {Authorization => "Bearer $token"}) -> result(); + + if ($locations_request -> code() == 200) { + my $locations = $locations_request -> json(); + + push @alert_details, { + alert_number => $alert -> {number}, + locations => $locations, + }; + } + } } - } - print "[+] Secret scanning alert(s) found. Blocking pipeline.\n"; - return 1; - } + if ($open_alerts > 0) { + print "[!] Total of open secret scanning alerts: $open_alerts\n"; + + foreach my $detail (@alert_details) { + print "[-] Alert $detail -> {alert_number} found in the following locations:\n"; + + foreach my $location (@{$detail -> {locations}}) { + print " File: $location -> {path}, Start line: $location -> {start_line}\n"; + } + } - else { - print "[+] No secret scanning alerts found.\n"; - return 0; - } - } + print "[+] Secret scanning alert(s) found. Blocking pipeline.\n"; + return 1; + } - else { - print "Error: Unable to fetch secret scanning alerts. HTTP status code: " . $request -> code() . "\n"; - return 1; + else { + print "[-] No secret scanning alerts found.\n"; + return 0; + } + } + + else { + print "Error: Unable to fetch secret scanning alerts. HTTP status code: " . $request -> code() . "\n"; + return 1; + } } } -1; +1; \ No newline at end of file