Skip to content

Commit a7951d6

Browse files
ursachecursachec
authored
Add NG SAST workflow examples (#6)
1 parent a0b7d0b commit a7951d6

File tree

4 files changed

+123
-0
lines changed

4 files changed

+123
-0
lines changed

‎.github/workflows/ngsast-docker.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# This workflow integrates ShiftLeft Inspect with GitHub
2+
# Visit https://docs.shiftleft.io for help
3+
name: ShiftLeft NG SAST Docker
4+
5+
on:
6+
pull_request:
7+
workflow_dispatch:
8+
9+
jobs:
10+
NextGen-Static-Analysis:
11+
runs-on: ubuntu-20.04
12+
steps:
13+
- uses: actions/checkout@v2
14+
- name: Download ShiftLeft CLI
15+
run: |
16+
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
17+
- name: Extract branch name
18+
shell: bash
19+
run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
20+
id: extract_branch
21+
- name: Analyze code inside Docker context
22+
run: |
23+
docker build --build-arg BRANCH="${{ github.head_ref || steps.extract_branch.outputs.branch }}" --build-arg SHIFTLEFT_ACCESS_TOKEN=$SHIFTLEFT_ACCESS_TOKEN .
24+
env:
25+
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
26+
27+
Build-Rules:
28+
runs-on: ubuntu-20.04
29+
needs: NextGen-Static-Analysis
30+
steps:
31+
- uses: actions/checkout@v2
32+
- name: Download ShiftLeft CLI
33+
run: |
34+
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
35+
- name: Extract branch name
36+
shell: bash
37+
run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
38+
id: extract_branch
39+
- name: Validate Build Rules
40+
run: ${GITHUB_WORKSPACE}/sl check-analysis --app flask-webgoat-docker --branch "${{ github.head_ref || steps.extract_branch.outputs.branch }}" --report --github-pr-number=${{github.event.number}} --github-pr-user=${{ github.repository_owner }} --github-pr-repo=${{ github.event.repository.name }} --github-token=${{ secrets.GITHUB_TOKEN }}
41+
env:
42+
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}

‎.github/workflows/ngsast.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# This workflow integrates ShiftLeft Inspect with GitHub
2+
# Visit https://docs.shiftleft.io for help
3+
name: ShiftLeft NG SAST
4+
5+
on:
6+
pull_request:
7+
workflow_dispatch:
8+
9+
jobs:
10+
NextGen-Static-Analysis:
11+
runs-on: ubuntu-20.04
12+
steps:
13+
- uses: actions/checkout@v2
14+
- name: Download ShiftLeft CLI
15+
run: |
16+
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
17+
- uses: actions/setup-python@v2
18+
with:
19+
python-version: '3.8.5'
20+
- name: Extract branch name
21+
shell: bash
22+
run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
23+
id: extract_branch
24+
- name: Analyze codebase
25+
run: |
26+
python3 -m venv .venv
27+
. .venv/bin/activate
28+
pip install --upgrade setuptools wheel
29+
pip install -r requirements.txt
30+
${GITHUB_WORKSPACE}/sl analyze --app flask-webgoat --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --python --cpg --godmodeon .
31+
env:
32+
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
33+
34+
Build-Rules:
35+
runs-on: ubuntu-20.04
36+
needs: NextGen-Static-Analysis
37+
steps:
38+
- uses: actions/checkout@v2
39+
- name: Download ShiftLeft CLI
40+
run: |
41+
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
42+
- name: Extract branch name
43+
shell: bash
44+
run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
45+
id: extract_branch
46+
- name: Validate Build Rules
47+
run: ${GITHUB_WORKSPACE}/sl check-analysis --app flask-webgoat --branch "${{ github.head_ref || steps.extract_branch.outputs.branch }}" --report --github-pr-number=${{github.event.number}} --github-pr-user=${{ github.repository_owner }} --github-pr-repo=${{ github.event.repository.name }} --github-token=${{ secrets.GITHUB_TOKEN }}
48+
env:
49+
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}

‎Dockerfile‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
FROM python:3.8.5-buster
2+
3+
# docker build --build-arg SHIFTLEFT_ACCESS_TOKEN=$SHIFTLEFT_ACCESS_TOKEN
4+
ARG SHIFTLEFT_ACCESS_TOKEN
5+
ARG BRANCH=master
6+
7+
WORKDIR /app
8+
COPY . /app/
9+
10+
# Download ShiftLeft
11+
RUN curl https://cdn.shiftleft.io/download/sl > sl && chmod a+rx sl
12+
13+
# Create virtual env
14+
RUN python3 -m venv .venv \
15+
&& . .venv/bin/activate \
16+
&& pip install --upgrade setuptools wheel \
17+
&& pip install -r requirements.txt
18+
19+
# Perform sl analysis
20+
RUN ./sl analyze --app flask-webgoat-docker --tag branch=$BRANCH --python --cpg --beta .

‎shiftleft.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
build_rules:
2+
- id: allow-ten-findings
3+
finding_types:
4+
- vuln
5+
- secret
6+
- insight
7+
- extscan
8+
severity:
9+
- SEVERITY_MEDIUM_IMPACT
10+
- SEVERITY_HIGH_IMPACT
11+
- SEVERITY_LOW_IMPACT
12+
threshold: 10

0 commit comments

Comments
 (0)