Skip to content

Commit 9992d8c

Browse files
dandelanydandelany
authored
New scan workflow + sonar project config file to enable sonarqube scans (#147)
* add new scan workflow + sonar project config file to enable sonarqube scans * use fetch-depth 0 when checking out repo for security scan * pin version for nasa-scrub dependency, remove old codeql scan
1 parent 3371bff commit 9992d8c

3 files changed

Lines changed: 144 additions & 49 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎.github/workflows/scan.yml‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
# AMMOS OSS Security Scan
2+
# (internal) docs - https://wiki.jpl.nasa.gov/pages/viewpage.action?spaceKey=AmmosArch&title=Code+Vulnerability+Scanning+Set+Up+for+AMMOS+Open+Source+Software
3+
name: "Security Scan"
4+
5+
on:
6+
push:
7+
branches:
8+
- develop
9+
tags:
10+
- 'v*'
11+
pull_request:
12+
branches:
13+
- develop
14+
- 'dev-[0-9]+.[0-9]+.[0-9]+'
15+
schedule:
16+
- cron: '42 2 * * 0' # weekly cron scan
17+
18+
jobs:
19+
analyze:
20+
name: Analyze (${{ matrix.language }})
21+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
22+
env:
23+
# PRs for forks can't use secrets, can't upload to Sonar
24+
CAN_USE_SECRETS: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
25+
permissions:
26+
# required for all workflows
27+
security-events: write
28+
# required to fetch internal or private CodeQL packs
29+
packages: read
30+
# only required for workflows in private repositories
31+
actions: read
32+
contents: read
33+
34+
strategy:
35+
fail-fast: false
36+
matrix:
37+
include:
38+
- language: actions
39+
build-mode: none
40+
- language: javascript-typescript
41+
build-mode: none
42+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
43+
steps:
44+
- name: Checkout repository
45+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 #v4.3.1
46+
with:
47+
fetch-depth: 0
48+
49+
# Add any setup steps before running the `github/codeql-action/init` action.
50+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
51+
# or others). This is typically only required for manual builds.
52+
# - name: Setup runtime (example)
53+
# uses: actions/setup-example@v1
54+
55+
# Initializes the CodeQL tools for scanning.
56+
- name: Initialize CodeQL
57+
uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba #4.35.5
58+
with:
59+
languages: ${{ matrix.language }}
60+
build-mode: ${{ matrix.build-mode }}
61+
# If you wish to specify custom queries, you can do so here or in a config file.
62+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
63+
# queries: security-extended,security-and-quality
64+
65+
# If the analyze step fails for one of the languages you are analyzing with
66+
# "We were unable to automatically build your code", modify the matrix above
67+
# to set the build mode to "manual" for that language. Then modify this step
68+
# to build your code.
69+
# ℹ️ Command-line programs to run using the OS shell.
70+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
71+
- name: Run manual build steps
72+
if: matrix.build-mode == 'manual'
73+
shell: bash
74+
run: |
75+
echo 'If you are using a "manual" build mode for one or more of the' \
76+
'languages you are analyzing, replace this with the commands to build' \
77+
'your code, for example:'
78+
echo ' make bootstrap'
79+
echo ' make release'
80+
exit 1
81+
82+
- name: Perform CodeQL Analysis
83+
uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba #4.35.5
84+
with:
85+
category: "/language:${{matrix.language}}"
86+
output: ../results
87+
88+
# This step is required by AMMOS to remove malformed data from the CodeQL output
89+
# It may be possible to remove in future iterations
90+
- name: Post-Process Output
91+
run: |
92+
python3 -m pip install nasa-scrub==3.0
93+
94+
results_dir=`realpath ${{ github.workspace }}/../results`
95+
sarif_files=`find $results_dir -name '*.sarif'`
96+
97+
for sarif_file in $sarif_files
98+
do
99+
output_file="$results_dir/$(basename $sarif_file .sarif)_stripped.sarif"
100+
101+
python3 -m scrub.tools.parsers.translate_results $sarif_file $output_file ${{ github.workspace }} sarifv2.1.0
102+
done
103+
104+
echo "RESULTS_DIR=$results_dir" >> $GITHUB_ENV
105+
106+
# This step makes the analysis artifacts available for download
107+
# This can be helpful for debugging and archive purposes
108+
- name: Upload Artifacts
109+
uses: actions/upload-artifact@v4.3.1
110+
with:
111+
name: codeql-artifacts-${{ matrix.language }}
112+
path: ${{ env.RESULTS_DIR }}
113+
114+
- name: collect stripped .sarif file paths
115+
if: env.CAN_USE_SECRETS == 'true'
116+
shell: bash
117+
run: |
118+
sarif_paths="$(find "${{ github.workspace }}/../results" -name '*_stripped.sarif' -type f | paste -sd, -)"
119+
echo "sarif paths: $sarif_paths"
120+
test -n "$sarif_paths"
121+
echo "SARIF_REPORT_PATHS=$sarif_paths" >> "$GITHUB_ENV"
122+
123+
- name: SonarQube Scan
124+
if: env.CAN_USE_SECRETS == 'true'
125+
uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
126+
env:
127+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
128+
with:
129+
args: >
130+
-Dsonar.sarifReportPaths=${{ env.SARIF_REPORT_PATHS }}

‎sonar-project.properties‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Project config file for SonarQube scans (run via GH actions)
2+
3+
sonar.projectKey=NASA-AMMOS_aerie-gateway
4+
sonar.organization=nasa-ammos
5+
6+
# name and version displayed in the SonarCloud UI.
7+
sonar.projectName="plandev-gateway"
8+
sonar.projectVersion="4.2.1"
9+
10+
# Path of sources to analyze relative to the sonar-project.properties file
11+
#sonar.sources=.
12+
13+
# Encoding of the source code. Default is default system encoding
14+
#sonar.sourceEncoding=UTF-8

0 commit comments

Comments
 (0)