forked from SaptarshiSarkar12/Drifty
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
68 changed files
with
1,927 additions
and
852 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| name: "CodeQL" | ||
|
|
||
| on: | ||
| push: # Run CodeQL analysis on every push to all branches | ||
| pull_request: # Run CodeQL analysis on every pull request to the repository | ||
| schedule: | ||
| - cron: '0 0 * * *' # Run CodeQL analysis at 00:00 UTC every day | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze | ||
| runs-on: 'ubuntu-latest' | ||
| timeout-minutes: 360 | ||
| permissions: | ||
| security-events: write | ||
| actions: read | ||
| contents: read | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: [ 'java-kotlin', 'javascript-typescript' ] | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| queries: security-extended,security-and-quality | ||
|
|
||
| - name: Setup JDK 21 | ||
| if: ${{ matrix.language == 'java-kotlin' }} | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: 'oracle' | ||
| java-version: 21 | ||
|
|
||
| - name: Build with Maven | ||
| if: ${{ matrix.language == 'java-kotlin' }} | ||
| run: mvn install | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 | ||
| with: | ||
| category: "/language:${{matrix.language}}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| name: 'Dependency Review' | ||
|
|
||
| on: | ||
| pull_request: | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
|
|
||
| jobs: | ||
| dependency-review: | ||
| name: Dependency Review | ||
| runs-on: 'ubuntu-latest' | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| - name: Dependency Review | ||
| uses: actions/dependency-review-action@v4 | ||
| with: | ||
| fail-on-scopes: development, runtime | ||
| comment-summary-in-pr: on-failure | ||
| retry-on-snapshot-warnings: true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,22 +5,48 @@ on: | |
| paths-ignore: | ||
| - "Website/**" | ||
| - "*.md" | ||
| pull_request: | ||
| pull_request_target: | ||
| paths-ignore: | ||
| - "Website/**" | ||
| - "*.md" | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| build: | ||
| build-and-scan: | ||
| name: Build and Scan [drifty-${{ matrix.image_name_suffix }}, ${{ matrix.os }}] | ||
| runs-on: ubuntu-latest | ||
| if: github.repository == 'SaptarshiSarkar12/Drifty' | ||
| strategy: | ||
| matrix: | ||
| os: [ 'ubuntu-latest', 'macos-14' ] # ubuntu-latest and macos-14 has amd64 and arm64 architecture respectively. | ||
| image_name_suffix: [ 'cli', 'gui' ] | ||
| fail-fast: false | ||
| permissions: | ||
| security-events: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Build the base image | ||
| run: docker compose build base | ||
| - name: Build the runner image | ||
| run: docker compose build runner | ||
| - name: Build the CLI image | ||
| run: docker compose build cli | ||
| - name: Build the GUI image | ||
| run: docker compose build gui | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| - name: Build Docker image | ||
| run: | | ||
| docker compose build base | ||
| docker compose build runner | ||
| docker compose build ${{ matrix.image_name_suffix }} | ||
| - name: Run Trivy security scan | ||
| uses: aquasecurity/[email protected] | ||
| continue-on-error: true | ||
| with: | ||
| image-ref: drifty-${{ matrix.image_name_suffix }} | ||
| format: 'sarif' | ||
| exit-code: 1 | ||
| vuln-type: os,library | ||
| ignore-unfixed: true | ||
| output: 'trivy-report.sarif' | ||
| hide-progress: false | ||
| scanners: vuln,secret,misconfig | ||
| - name: Upload Trivy security scan results | ||
| if: always() | ||
| uses: github/codeql-action/upload-sarif@main | ||
| with: | ||
| sarif_file: trivy-report.sarif | ||
Oops, something went wrong.