Skip to content

Commit 96989ce

Browse files
carmithershcarmithersh
authored
Merge pull request #5 from jfrog/CCS-2-Additional_evidence_examples
Additional evidence examples
2 parents 26a3b32 + 8078578 commit 96989ce

18 files changed

Lines changed: 1438 additions & 2 deletions

‎.github/workflows/jira-evidence-example.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: jira-evidence-example
2+
3+
on:
4+
workflow_dispatch: # This allows manual triggering of the workflow
5+
push:
6+
branches:
7+
- CCS-2-Additional_evidence_examples
8+
pull_request:
9+
branches:
10+
- CCS-2-Additional_evidence_examples
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
jobs:
16+
docker-build-with-jira-evidence:
17+
runs-on: ubuntu-latest
18+
env:
19+
DOCKER_REPO: 'test-docker-local'
20+
IMAGE_NAME: 'my-very-cool-image:${{ github.run_number }}'
21+
steps:
22+
- name: Install jfrog cli
23+
id: setup-cli
24+
uses: jfrog/setup-jfrog-cli@v4
25+
env:
26+
JF_URL: ${{ vars.ARTIFACTORY_URL }}
27+
with:
28+
oidc-provider-name: jfrog-github-oidc
29+
30+
- uses: actions/checkout@v4
31+
- name: Log in to Artifactory Docker Registry
32+
uses: docker/login-action@v3
33+
with:
34+
registry: ${{ vars.ARTIFACTORY_URL }}
35+
username: ${{ steps.setup-cli.outputs.oidc-user }}
36+
password: ${{ steps.setup-cli.outputs.oidc-token }}
37+
38+
- name: Set up Docker Buildx
39+
uses: docker/setup-buildx-action@v3
40+
41+
- name: Build and Push Docker image
42+
uses: docker/build-push-action@v6
43+
id: docker-build
44+
with:
45+
push: true
46+
provenance: false
47+
platforms: linux/amd64 #, linux/arm64
48+
build-args: REPO_URL=${{ vars.JF_URL }}/example-project-docker-dev-remote
49+
tags: ${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}
50+
51+
- name: add docker package to build
52+
run: |
53+
echo "${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}@${{ steps.docker-build.outputs.digest }}" > metadata.json
54+
jf rt build-docker-create ${{ env.DOCKER_REPO }} --image-file metadata.json --build-name $GITHUB_WORKFLOW --build-number ${{ github.run_number }}
55+
56+
- name: Publish build info
57+
if: ${{ true }}
58+
run: |
59+
jf rt build-collect-env
60+
jf rt build-add-git
61+
jf rt build-publish
62+
63+
- name: Create JIRA evidence
64+
env:
65+
jira_token: ${{ secrets.JIRA_TOKEN }}
66+
jira_username: ${{ secrets.JIRA_USERNAME }}
67+
jira_url: ${{ secrets.JIRA_URL }}
68+
run: |
69+
BRANCH_NAME=$(git branch --show-current)
70+
jira_id=$(echo "$BRANCH_NAME" | sed -E 's/^([^-]+-[0-9]+).*/\1/')
71+
echo "The branch name is: $BRANCH_NAME"
72+
echo "The jira_id is: $jira_id"
73+
# uncomment the line below to use the commit message instead of the branch name
74+
#START_COMMIT=$(git log -1 --format="%H %s")
75+
#jira_id=$(echo "$BRANCH_NAME" | cut -d' ' -f2)
76+
77+
# Check if the jira_id matches the JIRA ID format
78+
if [[ $jira_id =~ ^[A-Z]+-[0-9]+$ ]]; then
79+
echo "A valid JIRA ID was found in branch name: $jira_id"
80+
set +e
81+
./examples/jira-transition-example/bin/jira-transition-checker-linux-amd64 "Done" $jira_id > predicate.json
82+
# add --failOnMissingTransition to fail the build if the JIRA does not pass the transition check
83+
EXIT_CODE=$?
84+
set -e
85+
# create evidence only if the jira transition checker was successful
86+
if [ $EXIT_CODE -eq 0 ]; then
87+
# Attach evidence onto build using JFrog CLI
88+
jf evd create \
89+
--build-name $GITHUB_WORKFLOW \
90+
--build-number "${{ github.run_number }}" \
91+
--predicate ./predicate.json \
92+
--predicate-type https://jfrog.com/evidence/build-jira-transition/v1 \
93+
--key "${{ secrets.JIRA_TEST_PKEY }}" \
94+
--key-alias ${{ vars.JIRA_TEST_KEY }}
95+
else
96+
echo "JIRA transition checked completed with an error, or not all JIRAs pass the transition checked"
97+
fi
98+
else
99+
echo "No valid JIRA ID located in branch name: $BRANCH_NAME"
100+
fi

‎.github/workflows/sonar-evidence-example.yml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: sonar-evidence-example
2+
3+
on:
4+
workflow_dispatch: # This allows manual triggering of the workflow
5+
push:
6+
branches:
7+
- CCS-2-Additional_evidence_examples
8+
pull_request:
9+
branches:
10+
- CCS-2-Additional_evidence_examples
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
jobs:
16+
docker-build-with-sonar-evidence:
17+
runs-on: ubuntu-latest
18+
env:
19+
DOCKER_REPO: 'test-docker-local'
20+
IMAGE_NAME: 'my-very-cool-image:${{ github.run_number }}'
21+
steps:
22+
- name: Display workflow and job names
23+
run: |
24+
echo "Workflow name: $GITHUB_WORKFLOW"
25+
echo "Job name: $GITHUB_JOB"
26+
27+
- name: Install jfrog cli
28+
id: setup-cli
29+
uses: jfrog/setup-jfrog-cli@v4
30+
env:
31+
JF_URL: ${{ vars.ARTIFACTORY_URL }}
32+
with:
33+
oidc-provider-name: jfrog-github-oidc
34+
35+
- uses: actions/checkout@v4
36+
37+
- name: Install SonarQube Scanner
38+
run: |
39+
curl -sL -sSLo sonar-scanner.zip https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-6.2.1.4610.zip
40+
unzip sonar-scanner.zip
41+
export PATH=$PATH:$PWD/sonar-scanner-6.2.1.4610/bin
42+
pwd
43+
ls -l $PWD/sonar-scanner-6.2.1.4610/bin/
44+
echo "$PWD/sonar-scanner-6.2.1.4610/bin"
45+
- name: Set up JDK 17
46+
uses: actions/setup-java@v4
47+
with:
48+
java-version: '21' # Specify the desired Java version here
49+
distribution: 'temurin' # You can also use 'temurin', 'zulu', etc.
50+
51+
- name: Run SonarScanner
52+
id: run-sonar-scanner
53+
env:
54+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
55+
run: |
56+
$PWD/sonar-scanner-6.2.1.4610/bin/sonar-scanner \
57+
-Dsonar.projectKey=test-evidence \
58+
-Dsonar.organization=my-evidence-test-org \
59+
-Dsonar.host.url=https://sonarcloud.io \
60+
-Dsonar.java.jdkHome=$JAVA_HOME \
61+
-Dsonar.verbose=true \
62+
-Dsonar.token=$SONAR_TOKEN
63+
# create evidence from sonar-scan analysis
64+
set +e
65+
# --FailOnAnalysisFailure causes a failure on gateway-failed sonar analysis
66+
./examples/sonar-scan-example/bin/sonar-scan-extractor-linux-amd64 --reportTaskFile=$PWD/.scannerwork/report-task.txt > predicate.json
67+
EXIT_CODE=$?
68+
set -e
69+
# write the exit code to the github output so that it can be used in the evidence creation step
70+
echo "------predicate.json------"
71+
cat predicate.json
72+
echo "------sonar-scan.log------"
73+
cat sonar-scan.log
74+
echo "------EXIT------"
75+
echo "create-sonar-evidence=$EXIT_CODE"
76+
echo "create-sonar-evidence=$EXIT_CODE" >> $GITHUB_OUTPUT
77+
78+
79+
- name: Log in to Artifactory Docker Registry
80+
uses: docker/login-action@v3
81+
with:
82+
registry: ${{ vars.ARTIFACTORY_URL }}
83+
username: ${{ steps.setup-cli.outputs.oidc-user }}
84+
password: ${{ steps.setup-cli.outputs.oidc-token }}
85+
86+
- name: Set up Docker Buildx
87+
uses: docker/setup-buildx-action@v3
88+
89+
- name: Build and Push Docker image
90+
uses: docker/build-push-action@v6
91+
id: docker-build
92+
with:
93+
push: true
94+
provenance: false
95+
platforms: linux/amd64 #, linux/arm64
96+
build-args: REPO_URL=${{ vars.JF_URL }}/example-project-docker-dev-remote
97+
tags: ${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}
98+
99+
- name: add docker package to build
100+
run: |
101+
echo "${{ vars.JF_URL }}/${{ env.DOCKER_REPO }}/${{ env.IMAGE_NAME }}@${{ steps.docker-build.outputs.digest }}" > metadata.json
102+
jf rt build-docker-create ${{ env.DOCKER_REPO }} --image-file metadata.json --build-name $GITHUB_WORKFLOW --build-number ${{ github.run_number }}
103+
104+
- name: Publish build info
105+
if: ${{ true }}
106+
run: |
107+
jf rt build-collect-env
108+
jf rt build-add-git
109+
jf rt build-publish
110+
111+
- name: Create evidence
112+
if: ${{ steps.run-sonar-scanner.outputs.create-sonar-evidence == 0 }}
113+
run: |
114+
# Attach evidence onto build using JFrog CLI
115+
jf evd create \
116+
--build-name $GITHUB_WORKFLOW \
117+
--build-number "${{ github.run_number }}" \
118+
--predicate ./predicate.json \
119+
--predicate-type https://jfrog.com/evidence/sonar-scan/v1 \
120+
--key "${{ secrets.JIRA_TEST_PKEY }}" \
121+
--key-alias ${{ vars.JIRA_TEST_KEY }}

‎.github/workflows/zap-evidence-example.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: zap-evidence-example
2+
3+
on:
4+
workflow_dispatch: # This allows manual triggering of the workflow
5+
push:
6+
branches:
7+
- CCS-2-Additional_evidence_examples
8+
pull_request:
9+
branches:
10+
- CCS-2-Additional_evidence_examples
11+
permissions:
12+
id-token: write
13+
contents: read
14+
15+
16+
jobs:
17+
zap-evidence-example:
18+
runs-on: ubuntu-latest
19+
env:
20+
DOCKER_REPO: 'test-docker-local'
21+
IMAGE_NAME: 'my-very-cool-image'
22+
IMAGE_TAG: '40'
23+
BUILD_NAME: 'zap-evidence-example'
24+
steps:
25+
26+
- name: Install jfrog cli
27+
id: setup-cli
28+
uses: jfrog/setup-jfrog-cli@v4
29+
env:
30+
JF_URL: ${{ vars.ARTIFACTORY_URL }}
31+
with:
32+
oidc-provider-name: jfrog-github-oidc
33+
34+
- uses: actions/checkout@v4
35+
36+
- name: ZAP Scan
37+
run: |
38+
docker pull ghcr.io/zaproxy/zaproxy:stable
39+
# zap test the mock site https://www.example.com
40+
docker run -v /tmp:/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py -t https://www.example.com -J report_json.json || true
41+
echo "Zap completed!"
42+
ls -ltr /tmp
43+
# create summary json
44+
cat /tmp/report_json.json | jq -r '.site[].alerts[].riskcode' | sort | uniq -c | awk '{print "{\"riskcode\":\"" $2 "\", \"count\":" $1 "},"}' | sed '$ s/,$//' | awk 'BEGIN {print "["} {print} END {print "]"}' > report_summary.json
45+
# create full report predicate
46+
jq -s '{summary: .[0], details: .[1]}' report_summary.json /tmp/report_json.json > summary.json
47+
echo "-----------Summary of ZAP scan-----------"
48+
cat summary.json
49+
50+
- name: Evidence on docker
51+
run: |
52+
jf evd create \
53+
--package-name ${{ env.IMAGE_NAME }} \
54+
--package-version "${{ env.IMAGE_TAG }}" \
55+
--package-repo-name ${{ env.DOCKER_REPO }} \
56+
--key "${{ secrets.JIRA_TEST_PKEY }}" \
57+
--key-alias ${{ vars.JIRA_TEST_KEY }} \
58+
--predicate ./summary.json \
59+
--predicate-type https://jfrog.com/evidence/zap-scan/v1

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
/examples/sonar-scan-example/sonar-scanner-4.6.2.2472-linux/*
2+
/examples/sonar-scan-example/bin/*
3+
/examples/jira-transition-example/bin/*

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,3 +190,4 @@ When the Evidence service is used in conjunction with JFrog Xray, each Release B
190190
191191
To see a sample rego policy, go [here](https://github.com/jfrog/Evidence-Examples/blob/main/policy/policy.rego).
192192
For more information about integrating Release Lifecycle Management and Evidence with Xray, see [Scan Release Bundles (v2) with Xray](https://jfrog.com/help/r/jfrog-artifactory-documentation/scan-release-bundles-v2-with-xray).
193+

‎examples/jira-transition-example/README.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Create JIRA Transition Evidence from the build CI and attach it to the build info
2+
JIRA is an important tool for tracking issues and managing projects and holds all requirements for software changes as Tasks.
3+
For compliant software development, it is important to track requirements review and approval process as these confirm proper approval for code changes done and released.
4+
To allow automation of proper requirements review and approval, we create an evidence of any JIRA linked to the code commits during the build with confirmation it went through approval status before code was committed.
5+
Every company defines a different approval status, so in our example we allow the calling code send the name of the transition that shold be checked.
6+
7+
pre-requisites:
8+
1. Hold a cloud JIRA server (for selfhosted jira server, few code adjustments are required)
9+
2. Allow network access from your CI server to Jira server
10+
3. Define few environment variables: jira_url, jira_token, jira_username
11+
4. Commit comments must include the JIRA issue ID (e.g. <jira-project-key>-1234)
12+
13+
The example is based on the following steps:
14+
1. get the relevant commit IDs
15+
2. extract the JIRA IDs from all the build commits
16+
3. call the jira-transition-checker utility (use the binary for your build platform) with these arguments: "transition name" JIRA-ID [,JIRA-ID]
17+
for example:
18+
``./examples/jira-transition-example/bin/jira-transition-checker-linux-amd64 "Finance Approval" JIRA-486 PROJ-111 > predicate.json``
19+
optional arg: `--failOnMissingTransition` whihc will fail the script if any of the JIRA IDs sent did not pass the transition check
20+
4. call the evidence create cli with the predicate.json file
21+
for example:
22+
``jf evd create \
23+
--build-name "${{ env.BUILD_NAME }}" \
24+
--build-number "${{ github.run_number }}" \
25+
--predicate ./predicate.json \
26+
--predicate-type https://jfrog.com/evidence/requirements-approval/v1 \
27+
--key "${{ secrets.JIRA_TEST_PKEY }}" \
28+
--key-alias ${{ vars.JIRA_TEST_KEY }}``

‎examples/jira-transition-example/build-binary.sh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/usr/bin/env bash
2+
3+
# Script inspired by https://www.digitalocean.com/community/tutorials/how-to-build-go-executables-for-multiple-platforms-on-ubuntu-16-04
4+
5+
errorExit () {
6+
echo; echo "ERROR: $1"; echo
7+
exit 1
8+
}
9+
10+
BIN=jira-transition-checker
11+
rm -rf bin
12+
mkdir -p bin
13+
14+
echo "Building $BIN"
15+
#platforms=("darwin/amd64" "linux/arm64" "linux/amd64" "windows/amd64" "windows/386")
16+
platforms=("linux/arm64" "linux/amd64" "darwin/arm64" )
17+
18+
for p in "${platforms[@]}"; do
19+
platform_array=(${p//\// })
20+
GOOS=${platform_array[0]}
21+
GOARCH=${platform_array[1]}
22+
23+
echo -e "\nBuilding"
24+
echo "OS: $GOOS"
25+
echo "ARCH: $GOARCH"
26+
final_name=$BIN'-'$GOOS'-'$GOARCH
27+
if [ "$GOOS" = "windows" ]; then
28+
final_name+='.exe'
29+
fi
30+
31+
env GOOS="$GOOS" GOARCH="$GOARCH" go build -o bin/$final_name . || errorExit "Building $final_name failed"
32+
done
33+
34+
echo -e "\nDone!\nThe following binaries were created in the bin/ directory:"
35+
ls -1 bin/
36+
echo

0 commit comments

Comments
 (0)