Sync with plan

zpqrtbnk · Feb 26, 2024 · 7bb11ce · 7bb11ce
1 parent 8cc75f4
commit 7bb11ce
Showing 1 changed file with 132 additions and 10 deletions.
diff --git a/.github/workflows/jit-security.yml b/.github/workflows/jit-security.yml
@@ -1,5 +1,6 @@
 name: Workflows generated by the MVS plan
-'on':
+run-name: ${{fromJSON(github.event.inputs.client_payload).payload.job_title}}
+on:
   workflow_dispatch:
     inputs:
        client_payload:
@@ -12,22 +13,143 @@ permissions:
 
 jobs:
   enrich:
-    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'enrich'
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'enrich' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-enrichment-code'
     runs-on: ubuntu-20.04
-    timeout-minutes: 20
+    timeout-minutes: 60
     steps:
     - name: enrichment
       uses: jitsecurity-controls/[email protected]
       with:
         security_control: registry.jit.io/control-enrichment-slim:latest
-
-  secret-detection:
-    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'secret-detection'
+
+  remediation-pr:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'remediation-pr' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-remediation-pr'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: remediation-pr
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/open-remediation-pr-alpine:latest
+        security_control_output_file: /opt/code/jit-report/results.json
+
+  static-code-analysis-c-cpp:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-c-cpp' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-csharp:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-csharp' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-go:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-go' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: gosec
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-gosec-alpine:latest
+
+  static-code-analysis-java:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-java' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-js:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-js' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-kotlin:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-kotlin' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-php:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-php' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-python-semgrep:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-python-semgrep' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-ruby:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-ruby' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-rust:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-rust' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-scala:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-scala' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - name: semgrep
+      uses: jitsecurity-controls/[email protected]
+      with:
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+
+  static-code-analysis-swift:
+    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-swift' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast'
     runs-on: ubuntu-20.04
-    timeout-minutes: 20
+    timeout-minutes: 60
     steps:
-    - name: gitleaks
+    - name: semgrep
       uses: jitsecurity-controls/[email protected]
       with:
-        security_control: registry.jit.io/control-gitleaks-alpine:latest
-        security_control_output_file: /tmp/report.json
+        security_control: registry.jit.io/control-semgrep-alpine:latest
+