Skip to content

Commit 8b4e0fa

Browse files
jfrogdixitjfrogdixit
committed
Standardize Github workflow structure
1 parent 39fa9a1 commit 8b4e0fa

File tree

4 files changed

+92
-112
lines changed

4 files changed

+92
-112
lines changed

.github/workflows/codeql.yml renamed to .github/workflows/codeql-evidence-example.yml

Lines changed: 41 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
name : "CodeQL Analysis Workflow"
2-
1+
name : "Codeql Evidence Integration example"
32
on:
43
workflow_dispatch:
54

@@ -8,11 +7,12 @@ permissions:
87
contents: read
98
actions: read
109

11-
1210
jobs:
1311
codeql:
1412
name: Analyse
1513
runs-on: ubuntu-latest
14+
env:
15+
ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE: true
1616
strategy:
1717
fail-fast: false
1818
matrix:
@@ -23,73 +23,65 @@ jobs:
2323
queries_path: ./examples/codeql/queries/go
2424

2525
steps:
26-
- uses: actions/checkout@v4
27-
with:
28-
sparse-checkout: |
29-
examples/codeql/**
30-
sparse-checkout-cone-mode: false
31-
32-
- name: Set up CodeQL for ${{ matrix.language_details.name }}
33-
uses: github/codeql-action/init@v3
34-
with:
35-
languages: ${{ matrix.language_details.name }}
36-
config-file: examples/codeql/codeql-config.yml
37-
queries: ${{ matrix.language_details.queries_path }}
38-
39-
- name: Setup Jfrog CLI for go
26+
# Build and publish the packages to JFrog Artifactory
27+
- name: Setup jfrog cli
4028
uses: jfrog/setup-jfrog-cli@v4
4129
env:
4230
JF_URL: ${{ vars.ARTIFACTORY_URL }}
4331
JF_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}
44-
45-
46-
- name: Setup Go
47-
if: matrix.language_details.name == 'go'
48-
uses: actions/setup-go@v5
49-
with:
50-
go-version: '1.24.3'
51-
52-
53-
- name: Run CodeQL Analysis for ${{ matrix.language_details.name }}
54-
uses: github/codeql-action/analyze@v3
32+
- uses: actions/checkout@v4
5533
with:
56-
category: "security-and-quality"
57-
output: results-${{ matrix.language_details.name }}
58-
upload: false
59-
60-
- name: Convert SARIF to Markdown
61-
run: |
62-
python ./examples/codeql/sarif_to_markdown.py \
63-
results-${{ matrix.language_details.name }}/${{ matrix.language_details.name }}.sarif \
64-
results-${{ matrix.language_details.name }}/${{ matrix.language_details.name }}-report.md
65-
34+
sparse-checkout: |
35+
examples/codeql/**
36+
sparse-checkout-cone-mode: false
6637
- name: Build and Publish ${{ matrix.language_details.name }} package
6738
env:
6839
GO_CODE_PATH: examples/codeql/go
6940
JS_CODE_PATH: examples/codeql/js
7041
run: |
7142
if [ ${{ matrix.language_details.name }} == 'go' ]; then
7243
cd $GO_CODE_PATH
73-
# Configure JFrog CLI for Go
7444
jf go-config --repo-resolve=go-remote --repo-deploy=go-local \
7545
--server-id-deploy=setup-jfrog-cli-server \
76-
--server-id-resolve=setup-jfrog-cli-server
77-
46+
--server-id-resolve=setup-jfrog-cli-server
7847
jf gp --build-name=my-go-build --build-number=${{ github.run_number }} v0.0.${{ github.run_number }}
7948
jf rt bp my-go-build ${{ github.run_number }}
8049
elif [ ${{ matrix.language_details.name }} == 'javascript' ]; then
8150
cd $JS_CODE_PATH
8251
jf npm-config --repo-resolve=javascript-remote --repo-deploy=javascript-local \
8352
--server-id-deploy=setup-jfrog-cli-server \
8453
--server-id-resolve=setup-jfrog-cli-server
85-
8654
jf npm publish --build-name=my-javascript-build --build-number=${{ github.run_number }}
8755
jf rt bp my-javascript-build ${{ github.run_number }}
8856
fi
8957
cd -
9058
continue-on-error: true
9159

92-
- name: Attach Evidence Using JFrog CLI
60+
# Set up CodeQL and run analysis
61+
- name: Set up CodeQL for ${{ matrix.language_details.name }}
62+
uses: github/codeql-action/init@v3
63+
with:
64+
languages: ${{ matrix.language_details.name }}
65+
config-file: examples/codeql/codeql-config.yml
66+
queries: ${{ matrix.language_details.queries_path }}
67+
68+
- name: Run CodeQL Analysis for ${{ matrix.language_details.name }}
69+
uses: github/codeql-action/analyze@v3
70+
with:
71+
category: "security-and-quality"
72+
output: results-${{ matrix.language_details.name }}
73+
upload: false
74+
75+
# This is an optional step to generate a custom markdown report
76+
- name: Generate optional custom markdown report
77+
if: env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true'
78+
run: |
79+
python ./examples/codeql/sarif_to_markdown.py \
80+
results-${{ matrix.language_details.name }}/${{ matrix.language_details.name }}.sarif \
81+
results-${{ matrix.language_details.name }}/${{ matrix.language_details.name }}-report.md
82+
83+
# Attaching the evidence to associated package
84+
- name: Attach Evidence using JFrog CLI
9385
run: |
9486
jf config show
9587
if [ ${{ matrix.language_details.name }} == 'go' ]; then
@@ -98,20 +90,20 @@ jobs:
9890
--package-name "jfrog.com/mygobuild" \
9991
--package-version $PACKAGE_VERSION \
10092
--package-repo-name go-local \
101-
--key "${{ secrets.CODEQL_SIGNING_KEY }}" \
102-
--key-alias ${{ vars.CODEQL_KEY_ALIAS }} \
93+
--key "${{ secrets.PRIVATE_KEY }}" \
94+
--key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
10395
--predicate "results-go/go.sarif" \
10496
--predicate-type "http://github.com/CodeQL/static-analysis" \
105-
--markdown "results-go/go-report.md"
97+
${{ env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true' && '--markdown "results-go/go-report.md"' || '' }}
10698
elif [ ${{ matrix.language_details.name }} == 'javascript' ]; then
10799
PACKAGE_VERSION="0.0.1"
108100
jf evd create \
109101
--package-name my-javascript-build \
110102
--package-version $PACKAGE_VERSION \
111103
--package-repo-name javascript-local \
112-
--key "${{ secrets.CODEQL_SIGNING_KEY }}" \
113-
--key-alias ${{ vars.CODEQL_KEY_ALIAS }} \
104+
--key "${{ secrets.PRIVATE_KEY }}" \
105+
--key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
114106
--predicate "results-javascript/javascript.sarif" \
115107
--predicate-type "http://github.com/CodeQL/static-analysis" \
116-
--markdown "results-javascript/javascript-report.md"
108+
${{ env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true' && '--markdown "results-javascript/javascript-report.md"' || '' }}
117109
fi

‎.github/workflows/dependabot-evidence-example.yml‎

Lines changed: 23 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: dependabot-evidence-example
1+
name: "Dependabot evidence integration example"
22
on:
33
workflow_dispatch:
44

@@ -14,50 +14,28 @@ jobs:
1414
IMAGE_NAME: 'dependabot-docker-image'
1515
BUILD_NAME: 'dependabot-evidence-eg'
1616
VERSION: ${{ github.run_number }}
17-
REGISTRY_DOMAIN: ${{ vars.REGISTRY_DOMAIN }}
17+
REGISTRY_DOMAIN: ${{ vars.JF_URL }}
18+
ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE: true
1819

1920
steps:
20-
- name: Checkout code
21-
uses: actions/checkout@v4
22-
23-
- name: Setup JFrog CLI
21+
# Build and publish the packages to JFrog Artifactory
22+
- name: Setup jfrog cli
2423
uses: jfrog/setup-jfrog-cli@v4
2524
env:
2625
JF_URL: ${{ vars.ARTIFACTORY_URL }}
2726
JF_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}
28-
29-
- name: Log in to Artifactory Docker Registry
30-
uses: docker/login-action@v3
31-
with:
32-
registry: ${{ vars.ARTIFACTORY_URL }}
33-
username: ${{ secrets.JF_USER }}
34-
password: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}
35-
36-
- name: Set up Docker Buildx
37-
uses: docker/setup-buildx-action@v3
38-
27+
- name: Checkout code
28+
uses: actions/checkout@v4
3929
- name: Build and Push Docker Image to Artifactory
4030
run: |
4131
docker build -f ./examples/dependabot-alerts-example/Dockerfile . --tag $REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION
4232
jf rt docker-push $REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION $REPO_NAME --build-name=$BUILD_NAME --build-number=$VERSION
4333
44-
- name: Get Artifact Details
45-
run: |
46-
ARTIFACT_NAME="$REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION"
47-
echo "ARTIFACT_NAME=$ARTIFACT_NAME" >> $GITHUB_ENV
48-
49-
IMAGE_ID=$(docker images --format "{{.ID}}" "$ARTIFACT_NAME")
50-
echo "IMAGE_ID=$IMAGE_ID" >> $GITHUB_ENV
51-
52-
IMAGE_SIZE=$(docker images --format "{{.Size}}" "$ARTIFACT_NAME" | sed 's/MB//' | awk '{print $1 * 1024 * 1024}')
53-
echo "IMAGE_SIZE=$IMAGE_SIZE" >> $GITHUB_ENV
54-
55-
echo "SCAN_DATE="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"" >> $GITHUB_ENV
56-
34+
# Fetch Dependabot Vulnerability Snapshot
35+
# Github token with 'security_events: read' permission has to be provided
5736
- name: Fetch Dependabot Vulnerability Snapshot
58-
id: dependabot_snapshot
5937
env:
60-
GH_TOKEN: ${{ secrets.TOKEN_GIT }} # GitHub Token with 'security_events: read' permission is required
38+
GH_TOKEN: ${{ secrets.GH_PAT }}
6139
OWNER: ${{ github.repository_owner }}
6240
REPO: ${{ github.event.repository.name }}
6341
run: |
@@ -76,27 +54,33 @@ jobs:
7654
detectedAt: .created_at
7755
}
7856
]' > result.json
79-
8057
jq -n --argjson data "$(cat result.json)" '{ data: $data }' > dependabot.json
8158
82-
- name: Generate and Save Dependabot Markdown Report
59+
# This is an optional step to generate a custom markdown report
60+
- name: Generate optional custom markdown report
61+
if: env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true'
8362
run: |
63+
ARTIFACT_NAME="$REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION"
64+
IMAGE_ID=$(docker images --format "{{.ID}}" "$ARTIFACT_NAME")
65+
IMAGE_SIZE=$(docker images --format "{{.Size}}" "$ARTIFACT_NAME" | sed 's/MB//' | awk '{print $1 * 1024 * 1024}')
66+
SCAN_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
8467
python ./examples/dependabot-alerts-example/markdown_helper.py \
8568
"dependabot.json" \
8669
"dependabot_report.md" \
87-
"$ARTIFACT_NAME" \
70+
"$REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION" \
8871
"$SCAN_DATE" \
8972
"$IMAGE_ID" \
9073
"$IMAGE_SIZE"
9174
92-
- name: Create Dependabot Evidence
75+
# Attaching the evidence to associated package
76+
- name: Attach Evidence using JFrog CLI
9377
run: |
9478
jf evd create \
9579
--package-name $IMAGE_NAME \
9680
--package-version $VERSION \
9781
--package-repo-name $REPO_NAME \
98-
--key "${{ secrets.TEST_PRVT_KEY }}" \
99-
--key-alias ${{ vars.TEST_PUB_KEY_ALIAS }} \
82+
--key "${{ secrets.PRIVATE_KEY }}" \
83+
--key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
10084
--predicate ./dependabot.json \
10185
--predicate-type http://Github.com/Dependabot/static-analysis \
102-
--markdown dependabot_report.md
86+
${{ env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true' && '--markdown "dependabot_report.md"' || '' }}

‎.github/workflows/trivy-evidence-example.yml‎

Lines changed: 26 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
1-
name: trivy-evidence-example
2-
1+
name: "Trivy evidence integration example"
32
on:
43
workflow_dispatch:
54

@@ -11,52 +10,56 @@ jobs:
1110
package-docker-image-with-trivy-evidence:
1211
runs-on: ubuntu-latest
1312
env:
14-
REGISTRY_URL: ${{ vars.REGISTRY_DOMAIN }}
13+
REGISTRY_DOMAIN: ${{ vars.JF_URL }}
1514
REPO_NAME: 'docker-trivy-repo'
1615
IMAGE_NAME: 'docker-trivy-image'
1716
VERSION: ${{ github.run_number }}
1817
BUILD_NAME: 'trivy-docker-build'
18+
ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE: true
1919

2020
steps:
21-
- name: Install jfrog cli
21+
# Build and publish the packages to JFrog Artifactory
22+
- name: Setup jfrog cli
2223
uses: jfrog/setup-jfrog-cli@v4
2324
env:
2425
JF_URL: ${{ vars.ARTIFACTORY_URL }}
2526
JF_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}
26-
2727
- name: Checkout repository
2828
uses: actions/checkout@v4
29-
30-
- name: Build Docker Image
29+
- name: Build and publish Docker Image to Artifactory
3130
run: |
32-
docker build . --file ./examples/trivy-verify-example/Dockerfile --tag $REGISTRY_URL/$REPO_NAME/$IMAGE_NAME:$VERSION
31+
docker build . --file ./examples/trivy-verify-example/Dockerfile --tag $REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION
32+
echo "Pushing Docker Image to Artifactory"
33+
jf rt docker-push $REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION $REPO_NAME --build-name=$BUILD_NAME --build-number=${{ github.run_number }}
34+
echo "Pushing Docker Image to Artifactory completed"
35+
echo "publishing build info"
36+
jf rt build-publish $BUILD_NAME ${{ github.run_number }}
37+
38+
# Fetch Trivy Vulnerability Snapshot
3339
- name: Run Trivy
3440
uses: aquasecurity/trivy-action@master
3541
with:
36-
image-ref: ${{ env.REGISTRY_URL }}/${{ env.REPO_NAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
42+
image-ref: ${{ env.REGISTRY_DOMAIN }}/${{ env.REPO_NAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
3743
severity: HIGH,CRITICAL
3844
format: json
3945
output: trivy-results.json
4046

41-
- name: Convert Trivy JSON Output to Markdown
42-
run: python ./examples/trivy-verify-example/trivy_json_to_markdown_helper.py trivy-results.json
43-
44-
- name: Push Docker Image to Artifactory
45-
run: |
46-
echo "Pushing Docker image to Artifactory..."
47-
jf rt docker-push $REGISTRY_URL/$REPO_NAME/$IMAGE_NAME:$VERSION $REPO_NAME --build-name=$BUILD_NAME --build-number=${{ github.run_number }}
48-
- name: Publish Build Info
47+
# This is an optional step to generate a custom markdown report
48+
- name: Generate optional custom markdown report
49+
if: env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true'
4950
run: |
50-
jf rt build-publish $BUILD_NAME ${{ github.run_number }}
51-
- name: Attach Evidence Using JFrog CLI
51+
python ./examples/trivy-verify-example/trivy_json_to_markdown_helper.py trivy-results.json
52+
53+
# Attaching the evidence to associated package
54+
- name: Attach evidence using jfrog cli
5255
run: |
56+
ls -al
5357
jf evd create \
5458
--package-name $IMAGE_NAME \
5559
--package-version $VERSION \
5660
--package-repo-name $REPO_NAME \
57-
--key "${{ secrets.TRIVY_TEST_PKEY }}" \
58-
--key-alias ${{ vars.TRIVY_TEST_KEY }} \
61+
--key "${{ secrets.PRIVATE_KEY }}" \
62+
--key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \
5963
--predicate ./trivy-results.json \
6064
--predicate-type http://aquasec.com/trivy/security-scan \
61-
--markdown trivy-results.md
62-
echo "Trivy evidence attached to package"
65+
${{ env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true' && '--markdown "trivy-results.md"' || '' }}

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
/examples/sonar-scan-example/sonar-scanner-4.6.2.2472-linux/*
22
/examples/sonar-scan-example/bin/*
3-
/examples/jira-transition-example/bin/*
3+
/examples/jira-transition-example/bin/*
4+
*.pem

0 commit comments

Comments
 (0)