diff --git a/.github/workflows/jit-security.yml b/.github/workflows/jit-security.yml index 4452e676d3..0df1374df0 100644 --- a/.github/workflows/jit-security.yml +++ b/.github/workflows/jit-security.yml @@ -1,5 +1,6 @@ name: Workflows generated by the MVS plan -'on': +run-name: ${{fromJSON(github.event.inputs.client_payload).payload.job_title}} +on: workflow_dispatch: inputs: client_payload: @@ -12,22 +13,143 @@ permissions: jobs: enrich: - if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'enrich' + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'enrich' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-enrichment-code' runs-on: ubuntu-20.04 - timeout-minutes: 20 + timeout-minutes: 60 steps: - name: enrichment uses: jitsecurity-controls/jit-github-action@v4.2.0 with: security_control: registry.jit.io/control-enrichment-slim:latest - - secret-detection: - if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'secret-detection' + + remediation-pr: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'remediation-pr' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-remediation-pr' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: remediation-pr + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/open-remediation-pr-alpine:latest + security_control_output_file: /opt/code/jit-report/results.json + + static-code-analysis-c-cpp: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-c-cpp' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-csharp: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-csharp' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-go: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-go' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: gosec + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-gosec-alpine:latest + + static-code-analysis-java: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-java' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-js: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-js' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-kotlin: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-kotlin' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-php: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-php' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-python-semgrep: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-python-semgrep' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-ruby: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-ruby' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-rust: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-rust' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-scala: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-scala' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' + runs-on: ubuntu-20.04 + timeout-minutes: 60 + steps: + - name: semgrep + uses: jitsecurity-controls/jit-github-action@v4.2.0 + with: + security_control: registry.jit.io/control-semgrep-alpine:latest + + static-code-analysis-swift: + if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'static-code-analysis-swift' && fromJSON(github.event.inputs.client_payload).payload.workflow_slug == 'workflow-sast' runs-on: ubuntu-20.04 - timeout-minutes: 20 + timeout-minutes: 60 steps: - - name: gitleaks + - name: semgrep uses: jitsecurity-controls/jit-github-action@v4.2.0 with: - security_control: registry.jit.io/control-gitleaks-alpine:latest - security_control_output_file: /tmp/report.json \ No newline at end of file + security_control: registry.jit.io/control-semgrep-alpine:latest + \ No newline at end of file