doc: Security TRG 8 UPDATED

docs/release/trg-8/_category_.json

@@ -0,0 +1,3 @@
+{
+  "label": "TRG 8 - Security"
+}

docs/release/trg-8/trg-8-00.md

@@ -0,0 +1,66 @@
+---
+title: TRG 8.00 - Security Scanning Toolchain
+---
+
+| Status | Created     | Post-History                         |
+|--------|-------------|--------------------------------------|
+| Active | 21-Feb-2024 | Initial release                      |
+
+## Why
+
+Our primary aim is to improve security and define best practices across the Tractus-X ecosystem.
+
+## Description
+
+A security scanning toolchain is a collection of tools and processes that are used to scan software applications for security vulnerabilities. These tools can be used at various stages of the software development lifecycle (**SDLC**), from development to deployment and beyond.
+
+:::caution
+
+To pass the quality gates, all **critical** and **high** security vulnerabilities **must be mitigated**.
+
+:::
+
+## Tools that we’re using
+
+- ### SAST (Static Application Security Testing)
+
+Tools analyze source code or compiled binaries to identify potential vulnerabilities
+
+**Open-Source**: [CodeQL](/docs/release/trg-8/trg-8-01), [Snyk](/docs/release/trg-8/trg-8-06)
+
+- ### SCA (Software Composition Analysis)
+
+Tools examine the software components
+
+**Open-Source**: [Snyk](/docs/release/trg-8/trg-8-06)
+
+- ### DAST (Dynamic Application Security Testing)
+
+Tools test the application in it is running state to identify vulnerabilities that may not be detected by SAST
+
+**Open-Source**: [Owasp ZAP](/docs/release/trg-8/trg-8-05)
+
+- ### IaC (Infrastructure as Code)
+
+Tools that check the configuration files that define the infrastructure components of an application
+
+**Open-Source**: [KICS](/docs/release/trg-8/trg-8-03), [Snyk](/docs/release/trg-8/trg-8-06)
+
+- ### Secret Scanning
+
+Tools designed to search for and identify sensitive information, known as secrets, within code repositiories
+
+**Open-Source**: [GitGuardian](/docs/release/trg-8/trg-8-02)
+
+- ### Container Scanner
+
+Tools that scan the container images and the running containers
+
+**Open-Source**: [Trivy](/docs/release/trg-8/trg-8-04), [Snyk](/docs/release/trg-8/trg-8-06)
+
+:::tip
+
+Security is not a one-time activity, but a continuous process that requires constant attention and improvement.
+Even if you cannot perform a full **security assessment** for each product every release, you should at least follow basic security practices.
+
+:::

docs/release/trg-8/trg-8-01.md

@@ -0,0 +1,135 @@
+---
+title: TRG 8.01 - CodeQL
+---
+
+| Status | Created     | Post-History                         |
+|--------|-------------|--------------------------------------|
+| Active | 21-Feb-2024 | Initial release                      |
+
+## Why
+
+Our primary aim is to improve security and define best practices across the Tractus-X ecosystem.
+
+## Description
+
+A security scanning toolchain is a collection of tools and processes that are used to scan software applications for security vulnerabilities. These tools can be used at various stages of the software development lifecycle (**SDLC**), from development to deployment and beyond.
+
+### CodeQL
+
+**CodeQL** serves as our core code analysis tool (**SAST**), providing deep code introspection for potential security vulnerabilities and other code quality concerns.
+Below is a technical breakdown of how CodeQL integrates with our **CI/CD** process.
+
+:::info
+
+The CodeQL scan is triggered upon commits to the main branch, based on a CRON schedule set at 01:36 every Sunday, or when manually initiated.
+
+:::
+
+Given the range of languages CodeQL can analyze, the workflow leverages a matrix strategy to dynamically adjust runner settings based on the target language. It currently scans **Java**, **JavaScript**, **Python**, and **Ruby**, but this list is adjustable depending on the repository's dominant languages.
+
+:::info
+
+CodeQL supports a broader set of languages including 'cpp', 'csharp', 'go', 'swift', among others. Accordingly, adjustments should be made to the language matrix when different languages are in play.
+
+:::
+
+### The CodeQL analysis consists of several steps:
+
+- **Repository Checkout**: The repository content is fetched using actions/checkout@v3.
+
+- **CodeQL Initialization**: The github/codeql-action/init@v2 action initializes the CodeQL tools, setting the target languages and the desired query sets. CodeQL possesses an extensive collection of predefined queries, but developers can specify custom queries if necessary.
+
+- **Auto-build**: The github/codeql-action/autobuild@v2 action attempts to build any compiled languages. This auto-build feature can occasionally face issues and may fail, especially with complex build processes or non-standard configurations. If an auto-build failure occurs, developers must manually configure the build process within the workflow. An example is provided in the workflow to guide this manual setup.
+
+- **CodeQL Analysis**: Post build, CodeQL performs its analysis, examining the codebase for vulnerabilities and other concerns. Results are categorized based on the language of analysis.
+
+In the provided CodeQL workflow, specific queries are used to enhance security analysis: +security-extended,security-and-quality. The + symbol ensures that these queries are added to the default set, allowing for a comprehensive security analysis. Developers should be aware of these configured queries as they focus on identifying a broad range of vulnerabilities, ensuring robust code security and quality.
+
+```md
+/********************************************************************************
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["main"]
+  schedule:
+    - cron: "36 1 * * 0"
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners
+    # Consider using larger runners for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java", "javascript", "python", "ruby"]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
+        # Use only 'java' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          queries: +security-extended,security-and-quality
+
+      # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+      # Automates dependency installation for Python, Ruby, and JavaScript, optimizing the CodeQL analysis setup.
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #     echo "Run, Build Application using script"
+      #     ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{matrix.language}}"
+ ********************************************************************************/
+ ```
+

docs/release/trg-8/trg-8-02.md

@@ -0,0 +1,25 @@
+---
+title: TRG 8.02 - GitGuardian
+---
+
+| Status | Created     | Post-History                         |
+|--------|-------------|--------------------------------------|
+| Active | 21-Feb-2024 | Initial release                      |
+
+## Why
+
+Our primary aim is to improve security and define best practices across the Tractus-X ecosystem.
+
+## Description
+
+A security scanning toolchain is a collection of tools and processes that are used to scan software applications for security vulnerabilities. These tools can be used at various stages of the software development lifecycle (**SDLC**), from development to deployment and beyond.
+
+### GitGuardian
+
+**GitGuardian** is integrated via its GitHub App, enabling automated secret scanning of our codebase. Each pull request (PR) undergoes a scan. If a potential secret is detected, the commit's author receives an immediate email notification.
+
+:::info
+
+The email contains a temporary **link**, allowing the author to either **report** the detected secret or **mark it as a false positive**, streamlining the review process for software engineers.
+
+:::

docs/release/trg-8/trg-8-03.md

@@ -0,0 +1,91 @@
+---
+title: TRG 8.03 - KICS
+---
+
+| Status | Created     | Post-History                         |
+|--------|-------------|--------------------------------------|
+| Active | 21-Feb-2024 | Initial release                      |
+
+## Why
+
+Our primary aim is to improve security and define best practices across the Tractus-X ecosystem.
+
+## Description
+
+A security scanning toolchain is a collection of tools and processes that are used to scan software applications for security vulnerabilities. These tools can be used at various stages of the software development lifecycle (**SDLC**), from development to deployment and beyond.
+
+### KICS
+
+**KICS** is an integral tool in our security workflow, specifically targeting infrastructure-as-code (IaC) vulnerabilities. Here's how we've integrated KICS into our process:
+
+:::info
+
+When a push is made to the main branch or once daily (based on a CRON schedule), excluding markdown and text files, the KICS scan is triggered. Additionally, a manual dispatch option is available for on-demand scans.
+
+:::
+
+The job runs on the latest Ubuntu and requires permissions for reading actions and content, as well as writing security events. Upon initiation, the repository is checked out using the actions/checkout@v3 action.
+
+The primary action involves running the KICS scan, which leverages the checkmarx/[email protected]. The scan focuses on the root directory, and the results are outputted in the SARIF format, stored in the kicsResults/ directory.
+
+:::info
+
+KICS is configured to exit with a status code of 0, regardless of the scan results, unless there's a KICS engine error. Some paths and specific queries are excluded from the scan, and secret scanning is explicitly disabled.
+
+:::
+
+Subsequently, the SARIF file, which contains the KICS scan results, is uploaded using the github/codeql-action/upload-sarif@v2 action. This ensures that the findings are made available for review and further analysis in the GitHub environment, aiding engineers in addressing potential vulnerabilities effectively.
+
+```md
+/********************************************************************************
+name: Run KICS scan and upload SARIF
+
+on:
+  push:
+    branches: main
+    paths-ignore:
+      - "**/*.md"
+      - "**/*.txt"
+  schedule:
+    - cron: "0 0 * * *" # Once a day
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+
+      - name: Run KICS Scan with SARIF result
+        uses: checkmarx/[email protected]
+        with:
+          # Scanning directory .
+          path: "."
+          # When provided with a directory on output_path
+          # it will generate the specified reports file named 'results.{extension}'
+          # in this example it will generate: kicsResults/results.sarif
+          output_path: kicsResults/
+          output_formats: "sarif"
+          # If you want KICS to ignore the results and return exit status code 0 unless a KICS engine error happens
+          ignore_on_exit: results
+          # Exclude paths or files from scan
+          # exclude_paths: "terraform/gcp/big_data.tf,terraform/azure"
+          # Exclude accepted queries from the build
+          # exclude_queries: 0437633b-daa6-4bbc-8526-c0d2443b946e
+          # No secret scanning
+          disable_secrets: true
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: kicsResults/results.sarif
+ ********************************************************************************/
+ ```
+

docs/release/trg-8/trg-8-04.md

@@ -0,0 +1,71 @@
+---
+title: TRG 8.04 - Trivy
+---
+
+| Status | Created     | Post-History                         |
+|--------|-------------|--------------------------------------|
+| Active | 21-Feb-2024 | Initial release                      |
+
+## Why
+
+Our primary aim is to improve security and define best practices across the Tractus-X ecosystem.
+
+## Description
+
+A security scanning toolchain is a collection of tools and processes that are used to scan software applications for security vulnerabilities. These tools can be used at various stages of the software development lifecycle (**SDLC**), from development to deployment and beyond.
+
+### Trivy
+
+Trivy stands as our container vulnerability scanner of choice, ensuring the security of our container images by targeting both OS-level and library dependencies. Here's a concise breakdown of the Trivy integration in our workflow:
+
+:::info
+
+The Trivy scan is initiated either on-demand through manual dispatch or based on a CRON schedule, executing once daily. The job is executed on the latest Ubuntu and requires specified permissions: reading actions and content and writing security events.
+
+:::
+
+The primary step involves the Trivy vulnerability scanner pulling the container image tractusx/irs-api:latest from Docker Hub. Before scanning, it's essential to ensure that the desired image on Docker Hub is correctly configured for the scan.
+
+:::caution
+
+We recommend always scanning the most recently published image to maintain updated security assessments. Utilizing the aquasecurity/[email protected], the scanner inspects the image for vulnerabilities of types os and library. Results are formatted as SARIF and stored in trivy-results.sarif.
+
+:::
+
+After the scan, results are then uploaded to the GitHub Security tab via the github/codeql-action/upload-sarif@v2 action, ensuring engineers can efficiently review and address any highlighted vulnerabilities.
+
+```md
+/********************************************************************************
+name: "Run Trivy scan and upload SARIF"
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *" # Once a day
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      # Pull image from Docker Hub and run Trivy vulnerability scanner
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/[email protected]
+        with:
+          image-ref: "tractusx/irs-api:latest"
+          format: "sarif"
+          output: "trivy-results.sarif"
+          vuln-type: "os,library"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: "trivy-results.sarif"
+ ********************************************************************************/
+ ```
+