demo creds

.github/workflows/docker-builds.yaml → .github/workflows/build-and-publish-docker-artifacts.yaml

@@ -1,4 +1,4 @@
-name: Build and publish docker artifacts
+name: build-and-publish-docker-artifacts
 
 ###############################################################################
 # WARNING:
@@ -15,7 +15,7 @@ on:
       - 'release/**'
     tags:
       - '[0-9]+.[0-9]+.[0-9]+*'
-  pull_request_target:
+  pull_request:
     types: [ opened, synchronize ]
     paths:
     - 'Earthfile'
@@ -61,7 +61,7 @@ jobs:
       matrix: ${{fromJson(needs.set-matrix.outputs.matrix)}}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -124,7 +124,12 @@ jobs:
 
           if [ "$TRIGGERING_REF" == "pr" ]
           then
-
+            # At this point cf-gha-baseline has already checked out the PR input and failed the pipeline, but leaving this here for extra safety in case of future changes
+            if [[ ! '${{ github.event.pull_request.head.repo.full_name }}' =~ ^[a-zA-Z0-9._/-]+$ ]] || [[ ! '${{ github.event.pull_request.head.ref }}' =~ ^[a-zA-Z0-9._/-]+$ ]];
+            then
+              echo "[!] Invalid PR branch or repo name (!= ^[a-zA-Z0-9._/-]+\$). Aborting for security reasons."
+              exit 1
+            fi
             if [ "$IS_PR_FROM_FORK" == "true" ]; then
               echo "External PR detected: fetching branch from $PR_HEAD_REPO"
               git fetch https://github.com/${PR_HEAD_REPO}.git "$PR_HEAD_REF"

.github/workflows/build-test.yaml

@@ -0,0 +1,41 @@
+name: build-test
+
+on:
+  pull_request:
+    types: [ opened, synchronize ]
+  push:
+    branches:
+      - main
+      - develop
+      - release/**
+
+env:
+  NODE_OPTIONS: "--max_old_space_size=8192"
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v5
+      with:
+          submodules: recursive
+
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: "package.json"
+
+    - name: Install dependencies
+      run: npm ci
+
+    - name: Run ESLint (Core Only)
+      run: npx eslint src/core --ext .ts,.tsx
+
+    - name: Run unit tests
+
+      run: npm run test
+
+    - name: 🔨 Build project
+      run: npm run build

.github/workflows/dependency-check-google-osv.yaml

@@ -0,0 +1,54 @@
+name: dependency-check-google-osv
+
+on:
+  push:
+    paths: &shared-trigger-paths
+      - 'package.json'
+      - 'package-lock.json'
+      - 'ios/**'
+      - 'android/**'
+      - '**/*.gradle'
+      - '**/Podfile*'
+      - '**/Package*.swift'
+      - '.github/dependency-check-google-osv.yaml'
+    branches:
+      - main
+      - develop
+      - 'releases/**'
+  pull_request:
+    types: [ opened, synchronize ]
+    paths: *shared-trigger-paths
+  workflow_dispatch:
+
+jobs:
+  set-gitignore-artifact:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v5
+      with:
+        submodules: recursive
+
+    - name: Ignore services folder
+      run: |
+        echo 'services/*' >> .gitignore
+
+    - name: Upload .gitignore artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: gitignore-artifact
+        include-hidden-files: true
+        path: .gitignore
+
+  depcheck:
+    permissions:
+      actions: read
+      security-events: write
+      contents: read
+    needs: set-gitignore-artifact
+    uses: "google/osv-scanner-action/.github/workflows/[email protected]"
+    with:
+      download-artifact: gitignore-artifact
+      scan-args: |-
+        --recursive
+        ./

.github/workflows/dependency-check-npm-audit.yaml

@@ -0,0 +1,56 @@
+name: dependency-check-npm-audit
+
+on:
+  pull_request:
+    paths: &shared-trigger-paths
+      - 'package.json'
+      - 'package-lock.json'
+      - '.github/workflows/dependency-check-npm-audit.yaml'
+    types: [ opened, synchronize ]
+  push:
+    paths: *shared-trigger-paths
+    branches:
+      - main
+      - develop
+      - release/**
+
+env:
+  NODE_OPTIONS: "--max_old_space_size=8192"
+
+jobs:
+  depcheck:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v5
+      with:
+          submodules: recursive
+
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: "package.json"
+
+    - name: Run npm audit
+      env:
+        AUDIT_CI_VERSION: latest
+      run: |
+       # We always save the report so it's uploaded to the Security tab
+       npx -y audit-ci@${AUDIT_CI_VERSION} --report --report-type full --config audit-ci.jsonc -o json > audit.json || true
+       # We run it again in text mode to have a better output in the logs and let it fail if there are vulnerabilities (criticity set in audit-ci.jsonc)
+       npx -y audit-ci@${AUDIT_CI_VERSION} --report --report-type full --config audit-ci.jsonc
+
+    - name: Convert npm audit results to SARIF
+      if: always()
+      run: |
+        npx npm-audit-sarif audit.json > audit.sarif.json
+        # potentially fix levels that are not recognized by GitHub
+        jq '(.runs[].results[] | select(.level != "none" and .level != "note" and .level != "warning" and .level != "error") | .level) |= "warning"' audit.sarif.json > fixed-audit.sarif.json
+        mv fixed-audit.sarif.json audit.sarif.json
+
+    - name: Upload SARIF file to GitHub Security tab
+      if: always()
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: audit.sarif.json

.github/workflows/dependency-check-owasp-android.yml

@@ -0,0 +1,54 @@
+name: dependency-check-owasp-android
+
+on:
+  push:
+    paths: &shared-trigger-paths
+      - "android/**"
+      - "**/*.gradle"
+      - "**/gradle*.properties"
+      - ".github/workflows/dependency-check-owasp-android.yml"
+    branches:
+      - main
+      - develop
+      - 'releases/**'
+  pull_request:
+    paths: *shared-trigger-paths
+    types: [ opened, synchronize ]
+
+jobs:
+  depcheck:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    env:
+      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+
+      # Run OWASP Dependency-Check via the official Action
+      - name: Run Dependency-Check
+        uses: dependency-check/Dependency-Check_Action@main
+        with:
+          project: "veridian-wallet-android"
+          path: "android"
+          format: "ALL"
+          out: "reports"
+          args: "--failOnCVSS 7 --nvdApiKey ${{ env.NVD_API_KEY }} --disableCentral"
+        continue-on-error: false
+
+      - name: Upload HTML report
+        uses: actions/upload-artifact@v4
+        with:
+          name: depcheck-android-report
+          path: "reports/dependency-check-report.html"
+
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "reports/dependency-check-report.sarif"

.github/workflows/dependency-check-owasp-ios.yml

@@ -0,0 +1,54 @@
+name: dependency-check-owasp-ios
+
+on:
+  push:
+    paths: &shared-trigger-paths
+      - "ios/**"
+      - "**/Podfile*"
+      - "**/Package*.swift"
+      - ".github/workflows/dependency-check-owasp-ios.yml"
+    branches:
+      - main
+      - develop
+      - 'releases/**'
+  pull_request:
+    paths: *shared-trigger-paths
+    types: [ opened, synchronize ]
+
+jobs:
+  depcheck:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      security-events: write
+
+    env:
+      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+
+      # Run OWASP Dependency-Check via the official Action
+      - name: Run Dependency-Check
+        uses: dependency-check/Dependency-Check_Action@main
+        with:
+          project: "veridian-wallet-ios"
+          path: "ios"
+          format: "ALL"
+          out: "reports"
+          args: "--failOnCVSS 7 --nvdApiKey ${{ env.NVD_API_KEY }}"
+        continue-on-error: false
+
+      - name: Upload HTML report
+        uses: actions/upload-artifact@v4
+        with:
+          name: depcheck-ios-report
+          path: "reports/dependency-check-report.html"
+
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "reports/dependency-check-report.sarif"

.github/workflows/e2e_mobile_tests.yaml → .github/workflows/e2e-mobile-tests.yaml

@@ -1,4 +1,4 @@
-name: e2e mobile tests
+name: e2e-mobile-tests
 on:
   workflow_dispatch:
 jobs:
@@ -7,10 +7,12 @@ jobs:
     runs-on: [self-hosted, macOS, ARM64]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+
       - name: 🦾 Create .env file
         run: |
           echo APP_PATH=$HOME/Documents/xcode/DerivedData/Build/Products/Debug-iphonesimulator/App.app > .env
+
       - name: Setup node
         uses: actions/setup-node@v4
         with: