From e0238bb9d81617e2f33e6bfbf9f92a34012b7fdd Mon Sep 17 00:00:00 2001 From: james-otten Date: Thu, 2 May 2024 22:04:01 -0400 Subject: [PATCH 1/3] Create codeql.yaml --- .github/workflows/codeql.yaml | 57 +++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 .github/workflows/codeql.yaml diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml new file mode 100644 index 0000000..dfcb05b --- /dev/null +++ b/.github/workflows/codeql.yaml @@ -0,0 +1,57 @@ +name: "CodeQL" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '32 9 * * 6' + +permissions: read-all + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: 'ubuntu-latest' + timeout-minutes: 360 + permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: python + build-mode: none + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 # @v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - if: matrix.build-mode == 'manual' + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 # @v3 + with: + category: "/language:${{matrix.language}}" From adbd454284c0c20735d9c4d263939c6879556b1b Mon Sep 17 00:00:00 2001 From: james-otten Date: Thu, 2 May 2024 22:06:07 -0400 Subject: [PATCH 2/3] Create checkov.yaml --- .github/workflows/checkov.yaml | 41 ++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 .github/workflows/checkov.yaml diff --git a/.github/workflows/checkov.yaml b/.github/workflows/checkov.yaml new file mode 100644 index 0000000..10972d8 --- /dev/null +++ b/.github/workflows/checkov.yaml @@ -0,0 +1,41 @@ +name: Checkov + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '32 9 * * 6' + workflow_dispatch: + +permissions: read-all + +jobs: + checkov-job: + permissions: + actions: read + contents: read + security-events: write + statuses: none + runs-on: ubuntu-latest + name: checkov-action + steps: + - name: Checkout repo + uses: actions/checkout@master + + - name: Run Checkov action + id: checkov + uses: bridgecrewio/checkov-action@0549dc60bddd4c55cb85c6c3a07072e3cf2ca48e + with: + skip_check: CKV_DOCKER_2,CKV_DOCKER_3,CKV_SECRET_6 + quiet: true + output_format: cli,sarif + output_file_path: console,results.sarif + download_external_modules: true + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@d39d31e687223d841ef683f52467bd88e9b21c14 # v3 + if: success() || failure() + with: + sarif_file: results.sarif From 1899ed45332470aabfc0a21ae7f19c6b352414b8 Mon Sep 17 00:00:00 2001 From: james-otten Date: Tue, 14 May 2024 22:08:16 -0400 Subject: [PATCH 3/3] silence checkov --- .github/workflows/ci.yml | 4 ++++ .github/workflows/manual-live.yml | 4 +++- .github/workflows/manual_staging_deploy.yml | 4 +++- .github/workflows/manual_staging_stop.yml | 4 +++- .github/workflows/nightly_restart.yml | 4 ++++ 5 files changed, 17 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a87b90c..49ec5f4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,9 @@ name: CI/CD + on: [push] + +permissions: read-all + jobs: Test: runs-on: [ubuntu-latest] diff --git a/.github/workflows/manual-live.yml b/.github/workflows/manual-live.yml index fc84911..6ccb4e2 100644 --- a/.github/workflows/manual-live.yml +++ b/.github/workflows/manual-live.yml @@ -3,6 +3,8 @@ name: Manual live deploy on: workflow_dispatch +permissions: read-all + jobs: Run: runs-on: [self-hosted, daniel-server] @@ -23,4 +25,4 @@ jobs: docker stop nycmesh-support-bot || true docker rm nycmesh-support-bot || true docker build -t nycmesh-support-bot . - docker run -d --name nycmesh-support-bot -v "$PWD/.env:/app/.env" --restart unless-stopped nycmesh-support-bot supportbot-server --channel-ids "C679UKBUK" --channel-ids "C045QM9TDMZ" --nn-property-id "XfBTK3QZ1S" \ No newline at end of file + docker run -d --name nycmesh-support-bot -v "$PWD/.env:/app/.env" --restart unless-stopped nycmesh-support-bot supportbot-server --channel-ids "C679UKBUK" --channel-ids "C045QM9TDMZ" --nn-property-id "XfBTK3QZ1S" diff --git a/.github/workflows/manual_staging_deploy.yml b/.github/workflows/manual_staging_deploy.yml index d7725f4..758ede2 100644 --- a/.github/workflows/manual_staging_deploy.yml +++ b/.github/workflows/manual_staging_deploy.yml @@ -3,6 +3,8 @@ name: Manual staging deploy on: workflow_dispatch +permissions: read-all + jobs: Run: runs-on: [self-hosted, andy-server] @@ -14,4 +16,4 @@ jobs: run: | docker stop nycmesh-support-bot-test || true docker build -t nycmesh-support-bot-test . - docker run -d --name nycmesh-support-bot-test -v "/home/ubuntu/.env:/app/.env" --rm nycmesh-support-bot-test \ No newline at end of file + docker run -d --name nycmesh-support-bot-test -v "/home/ubuntu/.env:/app/.env" --rm nycmesh-support-bot-test diff --git a/.github/workflows/manual_staging_stop.yml b/.github/workflows/manual_staging_stop.yml index 1a69543..0067f5d 100644 --- a/.github/workflows/manual_staging_stop.yml +++ b/.github/workflows/manual_staging_stop.yml @@ -3,10 +3,12 @@ name: Manual staging stop on: workflow_dispatch +permissions: read-all + jobs: Run: runs-on: [self-hosted, andy-server] steps: - name: Stop staging server run: | - docker stop nycmesh-support-bot-test || true \ No newline at end of file + docker stop nycmesh-support-bot-test || true diff --git a/.github/workflows/nightly_restart.yml b/.github/workflows/nightly_restart.yml index d1acc24..7982d1e 100644 --- a/.github/workflows/nightly_restart.yml +++ b/.github/workflows/nightly_restart.yml @@ -1,7 +1,11 @@ name: Nighty Restart + on: schedule: - cron: "0 3 * * *" + +permissions: read-all + jobs: Restart: runs-on: [self-hosted, daniel-server]