Skip to content

Commit dd45c8e

Browse files
madhukarmosalimadhukarmosali
authored
Create snyk-zap.yml
1 parent bf97f9d commit dd45c8e

File tree

1 file changed

+157
-0
lines changed

1 file changed

+157
-0
lines changed

‎.github/workflows/snyk-zap.yml

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
# Define the name of the workflow
2+
name: snyk-zap
3+
4+
# Define when the workflow should be triggered (on push to a specific branch and pull requests to the main branch)
5+
on:
6+
push:
7+
branches: [ "master" ]
8+
pull_request:
9+
branches: [ "master" ]
10+
workflow_dispatch:
11+
12+
# Define the jobs that will be executed as part of the workflow
13+
jobs:
14+
# Job to build and push the ZAP Docker image to Docker Hub
15+
Snyk-Docker-Image:
16+
runs-on:
17+
group: ncats-awsci-runners
18+
permissions:
19+
actions: read
20+
contents: read
21+
security-events: write
22+
issues: write
23+
24+
outputs:
25+
build_version: ${{ steps.get_build_version.outputs.build_version }}
26+
27+
steps:
28+
# Step 1: Checkout repository
29+
- name: Checkout code
30+
uses: actions/checkout@v4
31+
32+
# Step 2: Generate Build Version Number
33+
- name: Generate Build Version Number
34+
id: GET_BUILD_VERSION
35+
run: |
36+
# Get the last recorded date from the environment variable
37+
LAST_DATE=$(date -d "$LAST_BUILD_DATE" +'%Y-%m-%d' 2>/dev/null || echo "")
38+
39+
# Get the current date
40+
CURRENT_DATE=$(date +'%Y-%m-%d')
41+
echo "Last recorded date: $LAST_DATE"
42+
echo "Current date: $CURRENT_DATE"
43+
44+
# Check if it's a new day
45+
if [ "$LAST_DATE" != "$CURRENT_DATE" ]; then
46+
# Reset BUILDS_TODAY to 0 for the new day
47+
BUILDS_TODAY=0
48+
echo "Resetting BUILDS_TODAY to 0 for the new day"
49+
else
50+
# Calculate the number of builds today
51+
BUILDS_TODAY=$(seq -f v$GITHUB_RUN_NUMBER.%g $(($GITHUB_RUN_NUMBER - 1)) | wc -l)
52+
echo "Incrementing BUILDS_TODAY"
53+
fi
54+
55+
# Store the current date for the next run
56+
echo "LAST_BUILD_DATE=$CURRENT_DATE" >> $GITHUB_ENV
57+
58+
# Generate the build version with the number of builds today
59+
BUILD_VERSION_GENERATED=$(date +v%Y.%m%d.$BUILDS_TODAY)
60+
echo "Generated Build Version: $BUILD_VERSION_GENERATED"
61+
echo "BUILD_VERSION=$BUILD_VERSION_GENERATED" >> $GITHUB_ENV
62+
echo "BUILD=true" >> $GITHUB_ENV
63+
echo "::set-output name=build_version::$BUILD_VERSION_GENERATED"
64+
65+
# Step 3: Login to Dockerhub
66+
- name: Login to Dockerhub
67+
run: docker login -u "${{ secrets.DKRHUB_NCATSSVCDVOPS_USERNAME }}" -p "${{ secrets.DKRHUB_NCATSSVCDVOPS_TOKEN_WRITE }}"
68+
69+
# Step 4: Build a Docker image
70+
- name: Build a Docker image
71+
run: docker build --no-cache -f ./Dockerfile --build-arg NPM_TOKEN=${{ secrets.NPM_INSTALL_TOKEN }} --build-arg BUILD_VERSION=$BUILD_VERSION -t registry.ncats.nih.gov:5000/projects-api:$BUILD_VERSION .
72+
73+
# Step 5: Run Snyk to check Docker image for vulnerabilities
74+
- name: Run Snyk to check Docker image for vulnerabilities
75+
continue-on-error: true
76+
uses: snyk/actions/docker@master
77+
id: docker-image-scan
78+
env:
79+
SNYK_TOKEN: ${{ secrets.SNYK_CLI }}
80+
with:
81+
image: registry.ncats.nih.gov:5000/projects-api:$BUILD_VERSION
82+
args: --sarif-file-output=snyk.sarif --file=Dockerfile
83+
84+
- name: Replace security-severity undefined for license-related findings
85+
continue-on-error: true
86+
run: |
87+
sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif
88+
sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
89+
90+
# Step 6: Upload result to GitHub Code Scanning
91+
- name: Upload result to GitHub Code Scanning
92+
continue-on-error: true
93+
uses: github/codeql-action/upload-sarif@v3
94+
with:
95+
sarif_file: snyk.sarif
96+
97+
# Step 7: Generate Security Report
98+
- name: Generate Security Report
99+
continue-on-error: true
100+
uses: rsdmike/[email protected]
101+
with:
102+
token: ${{ secrets.GITHUB_TOKEN }}
103+
104+
# Step 8: Uploads artifacts (PDF reports) generated during the workflow to download.
105+
- name: Upload Artifacts
106+
uses: actions/upload-artifact@v4
107+
with:
108+
name: reports
109+
path: ./*.pdf
110+
111+
ZAP-Docker-Scan:
112+
needs: Snyk-Docker-Image
113+
runs-on:
114+
group: ncats-awsci-runners
115+
permissions:
116+
actions: read
117+
contents: read
118+
security-events: write
119+
issues: write
120+
121+
steps:
122+
# Step 1: Get BUILD_VERSION from Snyk-Docker-Image job
123+
- name: Get BUILD_VERSION from Snyk-Docker-Image job
124+
id: get_runner_ip
125+
run: |
126+
echo "BUILD_VERSION=${{ needs.Snyk-Docker-Image.outputs.build_version }}" >> $GITHUB_ENV
127+
echo "::set-output name=runner_ip::$(hostname -I | cut -d' ' -f1)"
128+
129+
# Step 2: Add the command to start Docker image on port 8000
130+
- name: Start Docker image on port 8080
131+
continue-on-error: true
132+
run: docker run -d -p 8080:8000 registry.ncats.nih.gov:5000/projects-api:${{ needs.Snyk-Docker-Image.outputs.build_version }}
133+
134+
# Step 3: ZAP BASELINE SCAN
135+
- name: ZAP base Scan
136+
uses: zaproxy/[email protected]
137+
with:
138+
target: 'http://${{ steps.get_runner_ip.outputs.runner_ip }}:8080' # ip address of the runner
139+
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
140+
token: ${{ secrets.GITHUB_TOKEN }}
141+
fail_action: false
142+
143+
# Step 4: Create SARIF file from ZAP results
144+
- name: Create SARIF file from ZAP results
145+
continue-on-error: true
146+
uses: SvanBoxel/zaproxy-to-ghas@master
147+
148+
# Step 5: Upload SARIF file to GitHub Code Scanning
149+
- name: Upload SARIF file
150+
continue-on-error: true
151+
uses: github/codeql-action/upload-sarif@v3
152+
with:
153+
sarif_file: results.sarif
154+
155+
# Step 6: Stop and remove the Docker container
156+
- name: Stop and remove Docker container
157+
run: docker stop $(docker ps -q --filter ancestor=registry.ncats.nih.gov:5000/projects-api:$BUILD_VERSION) && docker rm $(docker ps -a -q --filter ancestor=registry.ncats.nih.gov:5000/projects-api:$BUILD_VERSION) || true

0 commit comments

Comments
 (0)