From 8a2b0b373374a770cab8478c835caad852ac753d Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Thu, 3 Oct 2024 19:19:20 -0400 Subject: [PATCH 1/5] Create devopsshield-scan-devops-controls.yml --- .../devopsshield-scan-devops-controls.yml | 40 +++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/workflows/devopsshield-scan-devops-controls.yml diff --git a/.github/workflows/devopsshield-scan-devops-controls.yml b/.github/workflows/devopsshield-scan-devops-controls.yml new file mode 100644 index 0000000..1708874 --- /dev/null +++ b/.github/workflows/devopsshield-scan-devops-controls.yml @@ -0,0 +1,40 @@ +name: DOS-SecurityScanner +on: + workflow_dispatch: + +permissions: + security-events: write + actions: read + contents: read + +jobs: + run_devopsshield_scanner: + name: DevOps Shield Security Scanner + runs-on: ubuntu-latest + environment: + name: dev + steps: + - name: checkout + uses: actions/checkout@v4.1.0 + - name: DevOps Shield Security Scanner Linux + run: |- + # Run DevOps Shield CLI with dosType=GitHub for current repository + docker run --name devopsshield \ + -v "${{ github.workspace }}:/devopsshield" \ + --rm -t \ + -e dosOrganizationName=${{ github.repository_owner }} \ + -e dosPatToken=${{ secrets.GITHUB_TOKEN }} \ + -e dosType=GitHub \ + devopsshield/devopsshield + ls ${{ github.workspace }} + cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif + cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv + mkdir "${{ github.workspace }}/devops-shield-reports-linux" + cp ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif "${{ github.workspace }}/devops-shield-reports-linux" + cp ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv "${{ github.workspace }}/devops-shield-reports-linux" + shell: bash + - name: Upload DevOps Shield Reports + uses: actions/upload-artifact@v4.1.0 + with: + name: devops-shield-reports-linux + path: "${{ github.workspace }}/devops-shield-reports-linux" From 32eeae9ccb3ae026da80dfeec40e4f8d98643107 Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Thu, 3 Oct 2024 19:28:39 -0400 Subject: [PATCH 2/5] Update devopsshield-scan-devops-controls.yml --- .github/workflows/devopsshield-scan-devops-controls.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/devopsshield-scan-devops-controls.yml b/.github/workflows/devopsshield-scan-devops-controls.yml index 1708874..d122f67 100644 --- a/.github/workflows/devopsshield-scan-devops-controls.yml +++ b/.github/workflows/devopsshield-scan-devops-controls.yml @@ -23,7 +23,7 @@ jobs: -v "${{ github.workspace }}:/devopsshield" \ --rm -t \ -e dosOrganizationName=${{ github.repository_owner }} \ - -e dosPatToken=${{ secrets.GITHUB_TOKEN }} \ + -e dosPatToken=${{ secrets.TOKEN_FOR_DOS }} \ -e dosType=GitHub \ devopsshield/devopsshield ls ${{ github.workspace }} From 402f9bbad8be9896a61d3108c977230081f72c47 Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Thu, 3 Oct 2024 21:49:15 -0400 Subject: [PATCH 3/5] Update devopsshield-scan-devops-controls.yml --- .github/workflows/devopsshield-scan-devops-controls.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/devopsshield-scan-devops-controls.yml b/.github/workflows/devopsshield-scan-devops-controls.yml index d122f67..e03b98e 100644 --- a/.github/workflows/devopsshield-scan-devops-controls.yml +++ b/.github/workflows/devopsshield-scan-devops-controls.yml @@ -37,4 +37,8 @@ jobs: uses: actions/upload-artifact@v4.1.0 with: name: devops-shield-reports-linux - path: "${{ github.workspace }}/devops-shield-reports-linux" + path: "${{ github.workspace }}/devops-shield-reports-linux" + - name: Upload results to Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif From b405d7ef6f8266b82492fde1e355bb1d2adede7c Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Thu, 3 Oct 2024 22:19:28 -0400 Subject: [PATCH 4/5] Update devopsshield-scan-devops-controls.yml --- .github/workflows/devopsshield-scan-devops-controls.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/devopsshield-scan-devops-controls.yml b/.github/workflows/devopsshield-scan-devops-controls.yml index e03b98e..6847a5d 100644 --- a/.github/workflows/devopsshield-scan-devops-controls.yml +++ b/.github/workflows/devopsshield-scan-devops-controls.yml @@ -38,7 +38,7 @@ jobs: with: name: devops-shield-reports-linux path: "${{ github.workspace }}/devops-shield-reports-linux" - - name: Upload results to Security tab - uses: github/codeql-action/upload-sarif@v2 + - name: Upload DevOps Shield Results to Security tab + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif From 45d0100bce88f2f6f4a62489a166780724d071b9 Mon Sep 17 00:00:00 2001 From: Calin Lupas Date: Sun, 6 Oct 2024 11:47:11 -0400 Subject: [PATCH 5/5] Update devopsshield-scan-devops-controls.yml --- .github/workflows/devopsshield-scan-devops-controls.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/devopsshield-scan-devops-controls.yml b/.github/workflows/devopsshield-scan-devops-controls.yml index 6847a5d..1de581f 100644 --- a/.github/workflows/devopsshield-scan-devops-controls.yml +++ b/.github/workflows/devopsshield-scan-devops-controls.yml @@ -26,7 +26,6 @@ jobs: -e dosPatToken=${{ secrets.TOKEN_FOR_DOS }} \ -e dosType=GitHub \ devopsshield/devopsshield - ls ${{ github.workspace }} cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv mkdir "${{ github.workspace }}/devops-shield-reports-linux"