DevSecOps pipeline with GitHub Actions #760

kulov · 2021-01-22T20:56:20Z

Resolves #750

DevSecOps pipeline with GitHub Actions to increase project confidence and maturity level.
This would increase project adoption to professional developers and enterprises who are much more willing to use secure and reliable OSS components but afraid of meeting quality and security bars.

PR Type

This PR adds new improved GitHub workflow to enable static code analysis, automatic releases and code signing using pfx file stored in GH Secrets.
This PR also adds GitHub Dependabot checks, runs CodeQL analysis and SonarCloud static source analysis.
This PR also provides all required documentation to configure all implemented tools and results with related screenshots.

Other information

Work still in progress.
This is no obligation, no strings attached work delivered to you and built with ❤ by Pipeline Foundation.
Any feedback will be taken in detailed consideration.
Support of final delivery will be provided for one year after PR approval.

Add Dependabot AB#174

Add CodeQL workflow AB#181

Add Dependabot entry to the docs AB#178

* Add SonarCloud and Testspace.

Add CodeQL entry to documentation

Add Manual Run entry to documentation AB#198

Add Code Scanning alerts bulk dismissal workflow AB#196 AB#203 AB#209 AB#210

Add initial entry for the release sequence to the documentation AB#202

duplicate of CI-CD Documentation.md

kulov · 2021-03-11T08:26:55Z

@Jasonstein, would you like to set the values of Package.StoreAssociation.xml using GitHub secrets?
We would be happy to do so if you provide us with the xml file.

0x7c13 · 2021-03-19T01:06:17Z

@Jasonstein, would you like to set the values of Package.StoreAssociation.xml using GitHub secrets?
We would be happy to do so if you provide us with the xml file.

I am fine with that, but what about putting the AppCenter's secret token in the Github secrets? How it can be applied to the code since it is actually a code change whenever I build the release package?

soumyamahunt · 2021-03-19T05:15:26Z

src/Notepads/Notepads.csproj

+        Lines="$([System.IO.File]::ReadAllText($(InputFile)).Replace('AppCenterSecret = null','AppCenterSecret = &quot;$(AppCenterSecret)&quot;'))"
+        Overwrite="true"
+        Encoding="Unicode"/>
+  </Target>


@Jasonstein This target will handle replacing AppCenterSecret with actual value. The actual value is passed on to MSBuild as an environment variable with the same name from Github secrets.

Awesome! I will add a comment in the code as well.

soumyamahunt · 2021-03-19T05:17:55Z

.github/workflows/main.yml

+          /p:AppxPackageDir=$env:ARTIFACTS_DIR `
+          /p:PackageCertificateKeyFile=$env:PACKAGE_CERTIFICATE_KEYFILE `
+          /p:PackageCertificatePassword=$env:PACKAGE_CERTIFICATE_PASSWORD `
+          /p:AppCenterSecret=$env:APP_CENTER_SECRET


@Jasonstein you just have to store the AppCenterSecret as APP_CENTER_SECRET in Github secrets.

soumyamahunt · 2021-03-19T05:32:41Z

@Jasonstein Also store upload task could be automated, @kulov are you interested in providing this??

…o devsecops

Update and revert PF/devsecops

add previous feedback changes

0x7c13 · 2021-03-19T23:47:49Z

@Jasonstein Also store upload task could be automated, @kulov are you interested in providing this??

@kulov PM me an email address and I will send you the Package.StoreAssociation.xml file.

kulov · 2021-03-20T00:16:32Z

@soumyamahunt Absolutely!

kulov · 2021-03-20T00:23:26Z

@Jasonstein, I've just sent you email.
Should it be Package.StoreAssociation.xml gets added to the PR after removing all secrets?

soumyamahunt · 2021-03-20T13:32:57Z

@Jasonstein Is there any security concern of keeping Package.StoreAssociation.xml in the repo itself?? Most UWP/MSIX repos keep this file in the repo itself.

0x7c13 · 2021-03-20T15:18:23Z

@Jasonstein Is there any security concern of keeping Package.StoreAssociation.xml in the repo itself?? Most UWP/MSIX repos keep this file in the repo itself.

I am actually thinking of it. There is no harm since there is no actual secret or certificate-related information stored as part of the store association.xml anyway.

soumyamahunt · 2021-03-22T13:29:16Z

src/Notepads/Package.targets

@@ -69,6 +69,17 @@
    </ItemGroup>
  </Target>

+  <Target Name="AssignAppCenterSecret" BeforeTargets="BeforeBuild" Condition=" $(AppCenterSecret) != '' ">


@aleks-ivanov Don't put this target in Package.targets, put it in the project file instead. The reason I created this separate file for targets is because of #523 and these common targets will be both imported by UWP project and packaging project. Since the AssignAppCenterSecret target is project specific it doesn't make any sense to put it in a separate file.

@soumyamahunt understood, I will move it back to the project file with the next feature merge 🙂

into devsecops

* add publish-to-store feature, add necessary files and changes and move AppCenterSecret to project file * update version in appxmanifest * add publish-to-store automation and documentation for it

aleks-ivanov · 2021-03-24T09:42:58Z

@soumyamahunt @Jasonstein

Please review the latest changes and let me know if everything is done correctly in terms of the project, manifest and association files, and if there is anything I've missed 🙂

I've thoroughly tested the automated submission creation in the Microsoft Partner Center and with the proper setup it works without a hitch. In the CI-CD_DOCUMENTATION.md under entry 6 (line 268), I've written the setup instructions. There are a few prerequisites, but they are all quite straight forward. Either way, let me know if you need any further assistance with the setup.

soumyamahunt · 2021-03-24T11:22:20Z

.github/workflows/main.yml

+
+      - name: Publish to Windows Store
+        id: publish_to_store
+        uses: isaacrlevin/windows-store-action@main


Replace with isaacrlevin/[email protected].

soumyamahunt · 2021-03-24T15:35:21Z

@aleks-ivanov @kulov is there any reason for separate codeql-analysis action, can't it just be included in ci job??

@Jasonstein the previous build action can be removed in favor of the main action, any thoughts??

aleks-ivanov · 2021-03-24T15:48:20Z

@soumyamahunt my reasoning for the separation is to allow the CodeQL analysis to run on a CRON schedule of - cron: '0 8 * * *, so that the project can make use of the constantly evolving CodeQL query database.

Also since the main pipeline doesn't require execution on that trigger, it is more elegant to separate them, than to pile on unnecessary logic.

0x7c13 · 2021-03-24T16:07:14Z

@aleks-ivanov @kulov is there any reason for separate codeql-analysis action, can't it just be included in ci job??

@Jasonstein the previous build action can be removed in favor of the main action, any thoughts??

Sure, we can remove the build.
Another question for you guys: what's the story of the versioning here based on the current CI/CD approach. Should we bump the version before triggering the CD pipeline for release or it can auto increment? @aleks-ivanov

aleks-ivanov · 2021-03-24T17:36:04Z

@Jasonstein

The automatic incrementing is certainly possible with the following changes to the pipeline use:

the commit message would determine if you want to bump the version or not
each commit that you wish to bump the version of the project, should be accompanied by a label corresponding to one of the version numbers (major, minor or patch):

git commit -m "fix: update language resource for Spanish" - this commit will create a new GitHub tag with bumped version from let's say if the latest GitHub tag is 1.0.0 to 1.0.1 automatically (the other two labels are feat for minor and perf for major with an additional footer tag of BREAKING CHANGE:)

consequently, that number can be used in any part of the pipeline e.g. to automatically bump the version in the Package.appxmanifest file, so that the build process executes with the new version

If that sounds good, we can create a separate PR with the change to automatic versioning, so you can compare the two implementations and see which one is more suitable to you ? 🙂

For further details, this is how the process works currently:

in the CI job of the pipeline, the version is retrieved from Identity.Version in the Package.appxmanifest file
then the latest tag's value is retrieved from the project's remote GitHub repo's tag list
based on those two values, several processes are evaluated for execution:

if the version is different from the tag AND the trigger of the pipeline is a push commit to the default branch -> a new tag is pushed to GitHub
if the version is different from the tag AND the trigger of the pipeline is a push commit to the default branch -> the whole CD job is executed, which includes the creation of the GitHub release and the submission to the Microsoft Partner Center (Windows Store)

So if the Identity.Version in the Package.appxmanifest is left the same as before (you don't manually bump it), those processes would be skipped.

0x7c13 · 2021-03-24T19:04:48Z

@Jasonstein

The automatic incrementing is certainly possible with the following changes to the pipeline use:

the commit message would determine if you want to bump the version or not

each commit that you wish to bump the version of the project, should be accompanied by a label corresponding to one of the version numbers (major, minor or patch):

git commit -m "fix: update language resource for Spanish" - this commit will create a new GitHub tag with bumped version from let's say if the latest GitHub tag is 1.0.0 to 1.0.1 automatically (the other two labels are feat for minor and perf for major with an additional footer tag of BREAKING CHANGE:)

consequently, that number can be used in any part of the pipeline e.g. to automatically bump the version in the Package.appxmanifest file, so that the build process executes with the new version

If that sounds good, we can create a separate PR with the change to automatic versioning, so you can compare the two implementations and see which one is more suitable to you ? 🙂

For further details, this is how the process works currently:

in the CI job of the pipeline, the version is retrieved from Identity.Version in the Package.appxmanifest file

then the latest tag's value is retrieved from the project's remote GitHub repo's tag list

based on those two values, several processes are evaluated for execution:

if the version is different from the tag AND the trigger of the pipeline is a push commit to the default branch -> a new tag is pushed to GitHub

if the version is different from the tag AND the trigger of the pipeline is a push commit to the default branch -> the whole CD job is executed, which includes the creation of the GitHub release and the submission to the Microsoft Partner Center (Windows Store)

So if the Identity.Version in the Package.appxmanifest is left the same as before (you don't manually bump it), those processes would be skipped.

Thanks, makes total sense. We can do it in a separate PR. Btw, really appreciate your work here for improving the CI/CD pipeline for Notepads and this looks awesome. @kulov @aleks-ivanov @soumyamahunt

aleks-ivanov and others added 30 commits January 12, 2021 14:35

add Dependabot with GHA and both .NET dependency sources as ecosystems

1a91252

add Dependabot with GHA and both .NET dependency sources as ecosystems

f32c823

add CodeQL

2057599

add CodeQL

509661b

increase page-size and change build configuration to Debug

5de6591

test Release build configuration

573839c

Add CodeQL

48de8a5

add Debug and remove explicit language declaration

c34f41a

add comment for the pagefile step and clean up the workflow

e6b7d85

create CI-CD_DOCUMENTATION.md and add Dependabot entry

aeace53

Merge pull request #1 from AleksIvanovSinglet/feature/dependabot

c2305bf

Add Dependabot AB#174

Merge pull request #2 from AleksIvanovSinglet/feature/codeql

bbd56b0

Add CodeQL workflow AB#181

Merge pull request #3 from AleksIvanovSinglet/feature/dependabot-docs

234b9c5

Add Dependabot entry to the docs AB#178

Add SonarCloud. (#4)

80acb42

* Add SonarCloud and Testspace.

add CodeQL entry to documentation

566e61c

Merge pull request #5 from AleksIvanovSinglet/feature/codeql-docs

98e9093

Add CodeQL entry to documentation

add Manual workflow run entry to documentation

d5dc611

correct step three of Manual run entry

1eec010

Merge pull request #6 from AleksIvanovSinglet/feature/manual-run-docs

d82ae8c

Add Manual Run entry to documentation AB#198

add initial entry for the release sequence

35409ab

add code scanning alerts bulk dismissal yml and test jq installation

fe00710

test jq installation

3cf21c3

test bulk alert dismissal script

89970fe

test secrets as variable vault

aeca8dd

remove push from workflow triggers

8027811

Merge pull request #8 from AleksIvanovSinglet/feature/csa-bulk-dismissal

a857401

Add Code Scanning alerts bulk dismissal workflow AB#196 AB#203 AB#209 AB#210

Merge pull request #7 from AleksIvanovSinglet/feature/release-init-docs

763f49b

Add initial entry for the release sequence to the documentation AB#202

Delete CI-CD Documentation.md

6d88de0

duplicate of CI-CD Documentation.md

add documentation entry for the 'Code scanning alerts bulk dismissal'

4c29e1b

clear the PAT step

645167b

soumyamahunt reviewed Mar 19, 2021

View reviewed changes

aleks-ivanov force-pushed the devsecops branch from e9eca7c to c84934a Compare March 19, 2021 14:05

aleks-ivanov and others added 4 commits March 19, 2021 16:34

Merge branch 'master' of https://github.com/aleks-ivanov/Notepads int…

2ac6467

…o devsecops

Merge pull request #37 from aleks-ivanov/devsecops

8180b6c

Update and revert PF/devsecops

add latest feedback changes

890261f

Merge pull request #38 from aleks-ivanov/feature/feedback

91292fd

add previous feedback changes

sync devsecops with master; move AppCenterSecret to Package.targets

70d4839

soumyamahunt suggested changes Mar 22, 2021

View reviewed changes

aleks-ivanov and others added 2 commits March 23, 2021 13:25

Merge branch 'master' of https://github.com/pipeline-foundation/Notepads

c3a0194

into devsecops

Add publish to WS automation and documentation for it AB#369 (#39)

6d3aa7d

* add publish-to-store feature, add necessary files and changes and move AppCenterSecret to project file * update version in appxmanifest * add publish-to-store automation and documentation for it

soumyamahunt suggested changes Mar 24, 2021

View reviewed changes

aleks-ivanov added 2 commits March 24, 2021 13:33

change publish-to-store action ref (#40)

01ed6e3

update app registration step (#41)

0c8833b

0x7c13 merged commit 38dfba1 into 0x7c13:master Mar 24, 2021

aleks-ivanov deleted the devsecops branch March 25, 2021 08:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

DevSecOps pipeline with GitHub Actions #760

DevSecOps pipeline with GitHub Actions #760

kulov commented Jan 22, 2021 •

edited

Loading

kulov commented Mar 11, 2021

0x7c13 commented Mar 19, 2021

soumyamahunt Mar 19, 2021

0x7c13 Mar 19, 2021

soumyamahunt Mar 19, 2021

soumyamahunt commented Mar 19, 2021

0x7c13 commented Mar 19, 2021

kulov commented Mar 20, 2021

kulov commented Mar 20, 2021

soumyamahunt commented Mar 20, 2021

0x7c13 commented Mar 20, 2021

soumyamahunt Mar 22, 2021

aleks-ivanov Mar 22, 2021 •

edited

Loading

aleks-ivanov commented Mar 24, 2021 •

edited

Loading

soumyamahunt Mar 24, 2021

soumyamahunt commented Mar 24, 2021

aleks-ivanov commented Mar 24, 2021 •

edited

Loading

0x7c13 commented Mar 24, 2021

aleks-ivanov commented Mar 24, 2021

0x7c13 commented Mar 24, 2021

DevSecOps pipeline with GitHub Actions #760

DevSecOps pipeline with GitHub Actions #760

Conversation

kulov commented Jan 22, 2021 • edited Loading

PR Type

Other information

kulov commented Mar 11, 2021

0x7c13 commented Mar 19, 2021

soumyamahunt Mar 19, 2021

Choose a reason for hiding this comment

0x7c13 Mar 19, 2021

Choose a reason for hiding this comment

soumyamahunt Mar 19, 2021

Choose a reason for hiding this comment

soumyamahunt commented Mar 19, 2021

0x7c13 commented Mar 19, 2021

kulov commented Mar 20, 2021

kulov commented Mar 20, 2021

soumyamahunt commented Mar 20, 2021

0x7c13 commented Mar 20, 2021

soumyamahunt Mar 22, 2021

Choose a reason for hiding this comment

aleks-ivanov Mar 22, 2021 • edited Loading

Choose a reason for hiding this comment

aleks-ivanov commented Mar 24, 2021 • edited Loading

soumyamahunt Mar 24, 2021

Choose a reason for hiding this comment

soumyamahunt commented Mar 24, 2021

aleks-ivanov commented Mar 24, 2021 • edited Loading

0x7c13 commented Mar 24, 2021

aleks-ivanov commented Mar 24, 2021

0x7c13 commented Mar 24, 2021

kulov commented Jan 22, 2021 •

edited

Loading

aleks-ivanov Mar 22, 2021 •

edited

Loading

aleks-ivanov commented Mar 24, 2021 •

edited

Loading

aleks-ivanov commented Mar 24, 2021 •

edited

Loading