diff --git a/.github/workflows/Securin-aspm.yaml b/.github/workflows/Securin-aspm.yaml new file mode 100644 index 0000000..170c65f --- /dev/null +++ b/.github/workflows/Securin-aspm.yaml @@ -0,0 +1,52 @@ +--- +name: Securin-ASPM +on: + pull_request: + branches: + - snyk-fix-18ceff2bfd97a0f0b4b1aeb017ad0d68 + workflow_dispatch: + inputs: + logLevel: + description: Log level +jobs: + scanning: + env: + APP_ID: aebfafd0a1a054492fe61df70ca4a849ff275f692fb7de073550dde9510a7caa + BRANCH_NAME: snyk-fix-18ceff2bfd97a0f0b4b1aeb017ad0d68 + SCAN_ID: 66c85e9fb46b3ffc265c18b52e81abfb59cd82158bc5387cfe81771e5db2f12a + REQ_URL_MAP: "${{toJSON('{\"SL_RESULT_API_HOST\":\"https://4296-223-178-86-69.ngrok.io/resultapi\"\ + ,\"SL_RESULTPARSER_API_HOST\":\"https://5a3b-223-178-86-69.ngrok.io/resultparserapi\"\ + }')}}" + steps: + - name: Retrieve Token Info + id: auth_token + run: "respJson=$(curl --location --request GET 'https://4296-223-178-86-69.ngrok.io/resultapi/aws/ecr/token'\ + \ --header 'Authorization: Bearer ${{secrets.CLI_ACCESS_TOKEN}}' --data-raw\ + \ ' ' ) \necho \"authTokenJson=$respJson\" >> $GITHUB_OUTPUT" + - uses: actions/checkout@v3 + - name: Scan Initiated + id: sec_scan_init + run: "usrVal=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).user}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrPassword=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).password}}'\ + \ | openssl enc -aes-256-cbc -d -base64 -A -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrPrxyUrl=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).proxyUrl}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \nusrImgTag=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).imageTag}}'\ + \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\ + \ ) \ndocker login --username $usrVal --password $usrPassword $usrPrxyUrl\ + \ \ndocker pull -q $usrImgTag \ndocker run -v ${{github.workspace}}:/src \ + \ --volume ${{github.workspace}}:/workdir -v /var/run/docker.sock:/var/run/docker.sock\ + \ $usrImgTag -access_tkn ${{secrets.CLI_ACCESS_TOKEN}} -app_id ${{ env.APP_ID\ + \ }} -scan_id ${{ env.SCAN_ID }} -branch_name ${{ env.BRANCH_NAME }} -req_url_map\ + \ ${{ env.REQ_URL_MAP }} -tool_name github event:${{ github.event_name }}\ + \ pr_number:${{ github.event.number }} -upload_log true" + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: "${{github.workspace}}/results/result.sarif" + if: hashFiles('**/result.sarif') !='' + - name: Evaluate build status + run: "cat ${{github.workspace}}/results/status.txt\nexit 1\n" + if: hashFiles('**/status.txt') !='' + runs-on: ubuntu-latest diff --git a/pom.xml b/pom.xml index 0ad745e..052cd84 100644 --- a/pom.xml +++ b/pom.xml @@ -42,7 +42,7 @@ org.springdoc springdoc-openapi-ui - 1.5.2 + 1.6.4 org.hsqldb