inteligr8/alfresco-community-repo
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-community-repo.git synced 2025-07-24 17:32:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

ACS-6304 Implement SAST Pipeline Scan (#2304)

Browse Source 
ACS-6304 Implement SAST Pipeline Scan
This commit is contained in:
mikolajbrzezinski
2023-12-13 10:57:43 +01:00
committed by GitHub
parent 3d0185574d
commit eff41eef12
1 changed files with 52 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
.github/workflows/ci.yml vendored
View File

@@ -46,12 +46,12 @@ jobs:
- name: "Clean Maven cache" - name: "Clean Maven cache"
run: bash ./scripts/ci/cleanup_cache.sh run: bash ./scripts/ci/cleanup_cache.sh
veracode: veracode_sca:
name: "Source Clear Scan (SCA)" name: "Source Clear Scan (SCA)"
runs-on: ubuntu-latest runs-on: ubuntu-latest
needs: [prepare] needs: [prepare]
if: > if: >
((github.ref_name == 'master' || startsWith(github.ref_name, 'release/')) && github.event_name != 'pull_request') && (github.ref_name == 'master' || startsWith(github.ref_name, 'release/') || github.event_name == 'pull_request') &&
!contains(github.event.head_commit.message, '[skip tests]') && !contains(github.event.head_commit.message, '[skip tests]') &&
!contains(github.event.head_commit.message, '[force') !contains(github.event.head_commit.message, '[force')
steps: steps:
@@ -68,6 +68,56 @@ jobs:
- name: "Clean Maven cache" - name: "Clean Maven cache"
run: bash ./scripts/ci/cleanup_cache.sh run: bash ./scripts/ci/cleanup_cache.sh
veracode_sast:
name: "Pipeline SAST Scan"
runs-on: ubuntu-latest
needs: [prepare]
if: >
(github.ref_name == 'master' || startsWith(github.ref_name, 'release/') || github.event_name == 'pull_request') &&
!contains(github.event.head_commit.message, '[skip tests]') &&
!contains(github.event.head_commit.message, '[force')
steps:
- uses: actions/checkout@v3
- uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.35.2
- uses: Alfresco/alfresco-build-tools/.github/actions/free-hosted-runner-disk-space@v1.35.2
- uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v1.35.2
- uses: Alfresco/alfresco-build-tools/.github/actions/github-download-file@v5.6.0
with:
token: ${{ secrets.BOT_GITHUB_TOKEN }}
repository: "Alfresco/veracode-baseline-archive"
file-path: "alfresco-community-repo/alfresco-community-repo-baseline.json"
target: "baseline.json"
- name: "Build"
timeout-minutes: ${{ fromJSON(env.GITHUB_ACTIONS_DEPLOY_TIMEOUT) }}
run: |
bash ./scripts/ci/init.sh
bash ./scripts/ci/build.sh
- name: "Run SAST Scan"
uses: veracode/Veracode-pipeline-scan-action@v1.0.10
with:
vid: ${{ secrets.VERACODE_API_ID }}
vkey: ${{ secrets.VERACODE_API_KEY }}
file: "packaging/war/target/alfresco.war"
fail_build: true
project_name: alfresco-community-repo
issue_details: true
veracode_policy_name: Alfresco Default
summary_output: true
summary_output_file: results.json
summary_display: true
baseline_file: baseline.json
- name: Upload scan result
if: success() || failure()
run: zip readable_output.zip results.json
- name: Upload Artifact
if: success() || failure()
uses: actions/upload-artifact@v3
with:
name: Veracode Pipeline-Scan Results (Human Readable)
path: readable_output.zip
- name: "Clean Maven cache"
run: bash ./scripts/ci/cleanup_cache.sh
pmd_scan: pmd_scan:
name: "PMD Scan" name: "PMD Scan"
runs-on: ubuntu-latest runs-on: ubuntu-latest