From 66d90146534bfda94d975149bcda8df4b4e94747 Mon Sep 17 00:00:00 2001 From: Tushar Pandey Date: Wed, 23 Oct 2024 22:25:26 +0530 Subject: [PATCH 1/4] added RL workflow --- .github/workflows/RL-secure.yml | 71 +++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/RL-secure.yml diff --git a/.github/workflows/RL-secure.yml b/.github/workflows/RL-secure.yml new file mode 100644 index 0000000..b8c432a --- /dev/null +++ b/.github/workflows/RL-secure.yml @@ -0,0 +1,71 @@ +name: RL-Secure +run-name: rl-scanner + +on: + merge_group: + workflow_dispatch: + push: + branches: ['main'] + pull_request: + types: + - opened + - synchronize + +jobs: + rl-scanner: + if: github.event_name == 'workflow_dispatch' || + (github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.ref, 'release/')) + runs-on: ubuntu-latest + + permissions: + pull-requests: write + id-token: write + + steps: + - uses: actions/checkout@v4 + + - name: Install npm dependencies + run: npm ci + + - name: Build Dist Folder + run: npm run build + + - name: Create tgz build artifact + run: | + tar -czvf vuejs-auth0.tgz * + - name: Get Artifact Version + id: get_version + run: echo "version=$(cat .version)" >> $GITHUB_ENV + + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: "3.10" + + - name: Install Python dependencies + run: | + pip install --upgrade pip + pip install boto3 requests + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v1 + with: + role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }} + aws-region: us-east-1 + mask-aws-account-id: true + + - name: Run Reversing Labs Wrapper Scanner + env: + RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} + WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple" + PYTHONUNBUFFERED: 1 + run: | + pip install rl-wrapper --index-url $WRAPPER_INDEX_URL && \ + rl-wrapper \ + --artifact "$(pwd)/node-auth0.tgz" \ + --name "${{ github.event.repository.name }}" \ + --version "${{ steps.get_version.outputs.version }}" \ + --repository "${{ github.repository }}" \ + --commit "${{ github.sha }}" \ + --build-env "github_action" \ No newline at end of file From daea28a456381c5dd418e321d493de00f6c7bb52 Mon Sep 17 00:00:00 2001 From: Tushar Pandey Date: Tue, 29 Oct 2024 22:41:46 +0530 Subject: [PATCH 2/4] updated RL impl --- .github/actions/rl-scanner/action.yml | 71 ++++++++++++++++++ .github/workflows/RL-secure.yml | 100 +++++++++++++------------- .github/workflows/release.yml | 14 ++++ 3 files changed, 133 insertions(+), 52 deletions(-) create mode 100644 .github/actions/rl-scanner/action.yml diff --git a/.github/actions/rl-scanner/action.yml b/.github/actions/rl-scanner/action.yml new file mode 100644 index 0000000..eb01713 --- /dev/null +++ b/.github/actions/rl-scanner/action.yml @@ -0,0 +1,71 @@ +name: 'Reversing Labs Scanner' +description: 'Runs the Reversing Labs scanner on a specified artifact.' +inputs: + artifact-path: + description: 'Path to the artifact to be scanned.' + required: true + version: + description: 'Version of the artifact.' + required: true + +runs: + using: 'composite' + steps: + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + + - name: Install Python dependencies + shell: bash + run: | + pip install boto3 requests + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v1 + with: + role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }} + aws-region: us-east-1 + mask-aws-account-id: true + + - name: Install RL Wrapper + shell: bash + run: | + pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple" + + - name: Run RL Scanner + shell: bash + env: + RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }} + PYTHONUNBUFFERED: 1 + run: | + if [ ! -f "${{ inputs.artifact-path }}" ]; then + echo "Artifact not found: ${{ inputs.artifact-path }}" + exit 1 + fi + + rl-wrapper \ + --artifact "${{ inputs.artifact-path }}" \ + --name "${{ github.event.repository.name }}" \ + --version "${{ inputs.version }}" \ + --repository "${{ github.repository }}" \ + --commit "${{ github.sha }}" \ + --build-env "github_actions" \ + --suppress_output + + # Check the outcome of the scanner + if [ $? -ne 0 ]; then + echo "RL Scanner failed." + echo "scan-status=failed" >> $GITHUB_ENV + exit 1 + else + echo "RL Scanner passed." + echo "scan-status=success" >> $GITHUB_ENV + fi + +outputs: + scan-status: + description: 'The outcome of the scan process.' + value: ${{ env.scan-status }} diff --git a/.github/workflows/RL-secure.yml b/.github/workflows/RL-secure.yml index b8c432a..96c4efb 100644 --- a/.github/workflows/RL-secure.yml +++ b/.github/workflows/RL-secure.yml @@ -1,71 +1,67 @@ -name: RL-Secure -run-name: rl-scanner +name: RL-Secure Workflow on: - merge_group: - workflow_dispatch: - push: - branches: ['main'] - pull_request: - types: - - opened - - synchronize + workflow_call: + inputs: + node-version: ## depends if build requires node else we can remove this. + required: true + type: string + artifact-name: + required: true + type: string + secrets: + RLSECURE_LICENSE: + required: true + RLSECURE_SITE_KEY: + required: true + SIGNAL_HANDLER_TOKEN: + required: true + PRODSEC_TOOLS_USER: + required: true + PRODSEC_TOOLS_TOKEN: + required: true + PRODSEC_TOOLS_ARN: + required: true jobs: rl-scanner: - if: github.event_name == 'workflow_dispatch' || - (github.event_name == 'pull_request' && startsWith(github.event.pull_request.head.ref, 'release/')) + name: Run Reversing Labs Scanner + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) runs-on: ubuntu-latest - - permissions: - pull-requests: write - id-token: write + outputs: + scan-status: ${{ steps.rl-scan-conclusion.outcome }} steps: - - uses: actions/checkout@v4 - - - name: Install npm dependencies - run: npm ci + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 - - name: Build Dist Folder - run: npm run build + - name: Build package + uses: ./.github/actions/build + with: + node: ${{ inputs.node-version }} - name: Create tgz build artifact run: | - tar -czvf vuejs-auth0.tgz * - - name: Get Artifact Version - id: get_version - run: echo "version=$(cat .version)" >> $GITHUB_ENV + tar -czvf ${{ inputs.artifact-name }} * - - name: Set up Python - uses: actions/setup-python@v4 - with: - python-version: "3.10" + - id: get_version + uses: ./.github/actions/get-version - - name: Install Python dependencies - run: | - pip install --upgrade pip - pip install boto3 requests - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v1 + - name: Run RL Scanner + id: rl-scan-conclusion + uses: ./.github/actions/rl-scanner with: - role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }} - aws-region: us-east-1 - mask-aws-account-id: true - - - name: Run Reversing Labs Wrapper Scanner + artifact-path: "$(pwd)/${{ inputs.artifact-name }}" + version: "${{ steps.get_version.outputs.version }}" env: RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} - WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple" - PYTHONUNBUFFERED: 1 - run: | - pip install rl-wrapper --index-url $WRAPPER_INDEX_URL && \ - rl-wrapper \ - --artifact "$(pwd)/node-auth0.tgz" \ - --name "${{ github.event.repository.name }}" \ - --version "${{ steps.get_version.outputs.version }}" \ - --repository "${{ github.repository }}" \ - --commit "${{ github.sha }}" \ - --build-env "github_action" \ No newline at end of file + PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} + PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} + PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} + + - name: Output scan result + run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 592a3e3..4cec76e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,8 +15,22 @@ permissions: ### TODO: Also remove `npm-release` workflow from this repo's .github/workflows folder once the repo is public. jobs: + rl-scanner: + uses: ./.github/workflows/rl-secure.yml + with: + node-version: 18 ## depends if build requires node else we can remove this. + artifact-name: 'auth0-vue.tgz' ## Will change respective to Repository + secrets: + RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} + PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} + PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} + PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} + release: uses: ./.github/workflows/npm-release.yml + needs: rl-scanner ## this is important as this will not let release job to run until rl-scanner is done with: node-version: 18 require-build: true From 8afa4d79070873836b073183df28370112344e93 Mon Sep 17 00:00:00 2001 From: Tushar Pandey Date: Thu, 31 Oct 2024 16:15:55 +0530 Subject: [PATCH 3/4] remove invalid workflow named file --- .github/workflows/RL-secure.yml | 67 --------------------------------- 1 file changed, 67 deletions(-) delete mode 100644 .github/workflows/RL-secure.yml diff --git a/.github/workflows/RL-secure.yml b/.github/workflows/RL-secure.yml deleted file mode 100644 index 96c4efb..0000000 --- a/.github/workflows/RL-secure.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: RL-Secure Workflow - -on: - workflow_call: - inputs: - node-version: ## depends if build requires node else we can remove this. - required: true - type: string - artifact-name: - required: true - type: string - secrets: - RLSECURE_LICENSE: - required: true - RLSECURE_SITE_KEY: - required: true - SIGNAL_HANDLER_TOKEN: - required: true - PRODSEC_TOOLS_USER: - required: true - PRODSEC_TOOLS_TOKEN: - required: true - PRODSEC_TOOLS_ARN: - required: true - -jobs: - rl-scanner: - name: Run Reversing Labs Scanner - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) - runs-on: ubuntu-latest - outputs: - scan-status: ${{ steps.rl-scan-conclusion.outcome }} - - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Build package - uses: ./.github/actions/build - with: - node: ${{ inputs.node-version }} - - - name: Create tgz build artifact - run: | - tar -czvf ${{ inputs.artifact-name }} * - - - id: get_version - uses: ./.github/actions/get-version - - - name: Run RL Scanner - id: rl-scan-conclusion - uses: ./.github/actions/rl-scanner - with: - artifact-path: "$(pwd)/${{ inputs.artifact-name }}" - version: "${{ steps.get_version.outputs.version }}" - env: - RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} - RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} - SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} - PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} - PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} - PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} - - - name: Output scan result - run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV \ No newline at end of file From 642aba2118fda995c39f52fb5770b2c0a1bcfbd6 Mon Sep 17 00:00:00 2001 From: Tushar Pandey Date: Thu, 31 Oct 2024 16:16:20 +0530 Subject: [PATCH 4/4] add correct workflow file name --- .github/workflows/rl-secure.yml | 67 +++++++++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 .github/workflows/rl-secure.yml diff --git a/.github/workflows/rl-secure.yml b/.github/workflows/rl-secure.yml new file mode 100644 index 0000000..96c4efb --- /dev/null +++ b/.github/workflows/rl-secure.yml @@ -0,0 +1,67 @@ +name: RL-Secure Workflow + +on: + workflow_call: + inputs: + node-version: ## depends if build requires node else we can remove this. + required: true + type: string + artifact-name: + required: true + type: string + secrets: + RLSECURE_LICENSE: + required: true + RLSECURE_SITE_KEY: + required: true + SIGNAL_HANDLER_TOKEN: + required: true + PRODSEC_TOOLS_USER: + required: true + PRODSEC_TOOLS_TOKEN: + required: true + PRODSEC_TOOLS_ARN: + required: true + +jobs: + rl-scanner: + name: Run Reversing Labs Scanner + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) + runs-on: ubuntu-latest + outputs: + scan-status: ${{ steps.rl-scan-conclusion.outcome }} + + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Build package + uses: ./.github/actions/build + with: + node: ${{ inputs.node-version }} + + - name: Create tgz build artifact + run: | + tar -czvf ${{ inputs.artifact-name }} * + + - id: get_version + uses: ./.github/actions/get-version + + - name: Run RL Scanner + id: rl-scan-conclusion + uses: ./.github/actions/rl-scanner + with: + artifact-path: "$(pwd)/${{ inputs.artifact-name }}" + version: "${{ steps.get_version.outputs.version }}" + env: + RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} + PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} + PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} + PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} + + - name: Output scan result + run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV \ No newline at end of file