Ci: Add Codeql and make trivy work for next containers #90

tom-rm-meyer-ISST · 2023-11-17T16:18:49Z

Description

As shown in issue sig-security#24, @scherersebastian showed how to setup the codeql scan and offered the review (comment).
I would love you to do the review!

Also as stated in configuring the trivy scans (#83) I updated the workflows to assign the latest tag to the current main branch to ensure trivy runs on non-release containers, too. Maybe you're also able to review that. If not it's fine.

Pre-review checks

Please ensure to do as many of the following checks as possible, before asking for committer review:

DEPENDENCIES are up-to-date. Dash license tool. Committers can open IP issues for restricted libs.
Copyright and license header are present on all affected files

.github/workflows/codeql.yml

github-advanced-security · 2023-11-17T16:21:03Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

.github/workflows/trivy.yml

tom-rm-meyer-ISST · 2023-11-17T16:46:04Z

also replaced versions of all workflows that reference a version (not main / master) to use the commit SHA. Thus, solves #86.

tom-rm-meyer-ISST · 2023-11-17T16:55:28Z

Java Backend currently failing due to failure in tests (none given yet). Therefore we need to check to:

either replace autobuild by building with skipTests (will also speed up as soon as tests are given) OR
create tests

scherersebastian · 2023-11-20T23:13:59Z

Java Backend currently failing due to failure in tests (none given yet). Therefore we need to check to:
* either replace autobuild by building with skipTests (will also speed up as soon as tests are given) OR

* create tests

@tom-rm-meyer-ISST the easiest way is to build it yourself, as reference you can see the IRS codeql workflow - they also use Java

scherersebastian · 2023-11-20T23:16:03Z

trivy should scan the "latest" images, not "main". I created this as a short term solution, so you can see your findings. At this time no image with a latest tag was released.
I think there is even a TRG for having a "latest" tag.

scherersebastian · 2023-11-20T23:17:10Z

Except of these minor changes, it looks good :)

tom-rm-meyer-ISST · 2023-11-21T06:04:30Z

trivy should scan the "latest" images, not "main". I created this as a short term solution, so you can see your findings. At this time no image with a latest tag was released. I think there is even a TRG for having a "latest" tag.

I'm confused again:

I adjusted the Workflow to also assign the latest tag to images currently created for main (no release as no specific tag has been set). The TRG seems to only refer to the latest tag for versions in images:

latest is set, if I create a version 1.5.6 image
latest is not set, if I just merge to main without further tag

I used the example worfklow as basis and now added the latest tag also for the second case.

We could dicsuss in the office hour whats actually the intended behavior.

But for now: Trivy currently scans the main tag? Then in this PR, we could change it to latest.

tom-rm-meyer-ISST · 2023-11-21T06:05:27Z

Java Backend currently failing due to failure in tests (none given yet). Therefore we need to check to:
* either replace autobuild by building with skipTests (will also speed up as soon as tests are given) OR

* create tests
@tom-rm-meyer-ISST the easiest way is to build it yourself, as reference you can see the IRS codeql workflow - they also use Java

Well, we have frontend and backend (javascript and java) that kind of adds some more steps. I'm meanwhile progressing with the testing so that we can merge this PR next week after I merged them :)

scherersebastian · 2023-11-26T21:40:33Z

@tom-rm-meyer-ISST which PR? I can do the changes for you, but please link the PR you are talking of.

tom-rm-meyer-ISST · 2023-11-28T15:09:28Z

@tom-rm-meyer-ISST which PR? I can do the changes for you, but please link the PR you are talking of.

Sorry @scherersebastian, I was talking about those two PR's (#91, #97) that added some tests. Those have been merged meanwhile.

After that I found out today, that the setup for the autobuild didn't work

I needed to bump the java version in the backend
I needed to setup java accordingly

The latter could be interesting for your recommended setups.

@scherersebastian could you please review this pr now? Everything seems to work now.

.github/workflows/trivy.yml

tom-rm-meyer-ISST · 2023-12-01T07:12:18Z

@scherersebastian resolved comment. Please approve, if fine :)

scherersebastian

LGTM

scherersebastian · 2023-11-30T16:10:55Z

.github/workflows/trivy.yml

@@ -61,14 +64,14 @@ jobs:
    steps:
      # Pull image from Docker Hub and run Trivy vulnerability scanner
      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.14.0
+        uses: aquasecurity/trivy-action@2b6a709cf9c4025c5438138008beaddbb02086f0 # v0.14.0
        with:
          image-ref: "tractusx/app-puris-backend:main"


main to latest

scherersebastian · 2023-11-30T16:13:36Z

.github/workflows/codeql.yml

+    # The branches below must be a subset of the branches above
+    branches: ["main"]
+  schedule:
+    - cron: "36 1 * * 0"


I would take this scan cycle 0 0 * * * , but this is up to you

it's once a day - it's free, why not :)

scherersebastian · 2023-11-30T16:19:20Z

.github/workflows/codeql.yml

+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["java", "javascript"]


Being honest, I am not one hundred percent sure, whether this will work.
javascript does not need autobuild.
I think the easiest solution is to test it out. Might be that you need to configure a separate set of steps just of javascript.
I would say, lets merge it, and see what happens - I will be there to help :)

tom-rm-meyer-ISST added 3 commits November 17, 2023 08:09

ci: added codeql scan for java and javascript

c8208f5

ci: set latest tag on main branch

f037259

Merge branch 'main' into ci/security

b73aa08

github-advanced-security bot found potential problems Nov 17, 2023

View reviewed changes

.github/workflows/codeql.yml Fixed Show fixed Hide fixed

.github/workflows/codeql.yml Fixed Show fixed Hide fixed

.github/workflows/codeql.yml Fixed Show fixed Hide fixed

tom-rm-meyer-ISST added 2 commits November 17, 2023 08:41

chore: replaced version by commits for all non master/main versions

8f1cf51

chore: merged upstream

d3fd1d5

github-advanced-security bot found potential problems Nov 17, 2023

View reviewed changes

.github/workflows/trivy.yml Fixed Show fixed Hide fixed

chore: replaced trivy versions by commits

9b1be19

chore: replaced trivy versions by commits

adbd0fd

tom-rm-meyer-ISST added 5 commits November 28, 2023 05:58

Merge branch 'main' into ci/security

83e58cf

chore: bump java version

7bc83bd

ci(codeql): added step to setup java

a23d2c2

fix(codeql): added missing parameters

4111b6e

fix(codeql): remove unused cache-dependency path

f431cf9

tom-rm-meyer-ISST requested a review from scherersebastian November 28, 2023 15:09

Merge branch 'main' into ci/security

b56c318

scherersebastian reviewed Nov 30, 2023

View reviewed changes

.github/workflows/trivy.yml Outdated Show resolved Hide resolved

fix: look for latest instead of main tag in trivy

52970ba

chore: updated licenses

8c85b57

Merge branch 'main' into ci/security

c063cac

scherersebastian approved these changes Dec 4, 2023

View reviewed changes

tom-rm-meyer-ISST merged commit 11f40b4 into eclipse-tractusx:main Dec 4, 2023
12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ci: Add Codeql and make trivy work for next containers #90

Ci: Add Codeql and make trivy work for next containers #90

tom-rm-meyer-ISST commented Nov 17, 2023 •

edited

Loading

github-advanced-security bot commented Nov 17, 2023

tom-rm-meyer-ISST commented Nov 17, 2023

tom-rm-meyer-ISST commented Nov 17, 2023

scherersebastian commented Nov 20, 2023

scherersebastian commented Nov 20, 2023

scherersebastian commented Nov 20, 2023

tom-rm-meyer-ISST commented Nov 21, 2023

tom-rm-meyer-ISST commented Nov 21, 2023

scherersebastian commented Nov 26, 2023

tom-rm-meyer-ISST commented Nov 28, 2023

tom-rm-meyer-ISST commented Dec 1, 2023

scherersebastian left a comment

scherersebastian Nov 30, 2023

scherersebastian Nov 30, 2023

scherersebastian Nov 30, 2023

scherersebastian Nov 30, 2023

Ci: Add Codeql and make trivy work for next containers #90

Ci: Add Codeql and make trivy work for next containers #90

Conversation

tom-rm-meyer-ISST commented Nov 17, 2023 • edited Loading

Description

Pre-review checks

github-advanced-security bot commented Nov 17, 2023

tom-rm-meyer-ISST commented Nov 17, 2023

tom-rm-meyer-ISST commented Nov 17, 2023

scherersebastian commented Nov 20, 2023

scherersebastian commented Nov 20, 2023

scherersebastian commented Nov 20, 2023

tom-rm-meyer-ISST commented Nov 21, 2023

tom-rm-meyer-ISST commented Nov 21, 2023

scherersebastian commented Nov 26, 2023

tom-rm-meyer-ISST commented Nov 28, 2023

tom-rm-meyer-ISST commented Dec 1, 2023

scherersebastian left a comment

Choose a reason for hiding this comment

scherersebastian Nov 30, 2023

Choose a reason for hiding this comment

scherersebastian Nov 30, 2023

Choose a reason for hiding this comment

scherersebastian Nov 30, 2023

Choose a reason for hiding this comment

scherersebastian Nov 30, 2023

Choose a reason for hiding this comment

tom-rm-meyer-ISST commented Nov 17, 2023 •

edited

Loading