Skip to content

Commit 0774fd0

Browse files
dervoetidervoeti
committed
Merge branch 'dev' of https://github.com/MaibornWolff/SecObserve into stackable
2 parents 96f5d3f + 32eec03 commit 0774fd0

File tree

309 files changed

+8325
-4499
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

309 files changed

+8325
-4499
lines changed

‎.github/workflows/build_push_dev.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
-
3838
name: Build and push backend
3939
id: build-and-push-backend
40-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
40+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
4141
with:
4242
context: .
4343
file: ./docker/backend/prod/django/Dockerfile
@@ -78,7 +78,7 @@ jobs:
7878
-
7979
name: Build and push frontend
8080
id: build-and-push-frontend
81-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
81+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
8282
with:
8383
context: .
8484
file: ./docker/frontend/prod/Dockerfile

‎.github/workflows/build_push_release.yml‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
3737
-
3838
name: Build and push backend
39-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
39+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
4040
with:
4141
context: .
4242
file: ./docker/backend/prod/django/Dockerfile
@@ -74,7 +74,7 @@ jobs:
7474
run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
7575
-
7676
name: Build and push frontend
77-
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
77+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
7878
with:
7979
context: .
8080
file: ./docker/frontend/prod/Dockerfile
@@ -98,13 +98,13 @@ jobs:
9898
ref: 'v${{ github.event.inputs.release }}'
9999
-
100100
name: Run vulnerability scanners for images
101-
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@2f7b500fde2de2bdea7eef3b6df5503c2476916f # main
101+
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@32595f58f393dbc99507c7ec574e47c3443808f1 # main
102102
with:
103103
so_configuration: 'so_configuration_sca_current.yml'
104104
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}
105105
-
106106
name: Run vulnerability scanners for endpoints
107-
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@2f7b500fde2de2bdea7eef3b6df5503c2476916f # main
107+
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@32595f58f393dbc99507c7ec574e47c3443808f1 # main
108108
with:
109109
so_configuration: 'so_configuration_endpoints.yml'
110110
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}
@@ -115,7 +115,7 @@ jobs:
115115
permissions:
116116
contents: write
117117
steps:
118-
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
118+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
119119
with:
120120
node-version: 20
121121
-
@@ -126,16 +126,18 @@ jobs:
126126
-
127127
name: Install programs
128128
env:
129-
CDXGEN_VERSION: 10.9.4
130-
SBOM_UTILITY_VERSION: 0.16.0
131-
CYCLONE_DX_CLI_VERSION: 0.25.1
129+
CDXGEN_VERSION: 11.2.3
130+
TRIVY_VERSION: 0.61.0
131+
SBOM_UTILITY_VERSION: 0.17.0
132+
CYCLONE_DX_CLI_VERSION: 0.27.2
132133
run: |
133134
npm install -g @cyclonedx/cdxgen@"$CDXGEN_VERSION"
134135
cd /usr/local/bin
135136
wget --no-verbose https://github.com/CycloneDX/sbom-utility/releases/download/v"$SBOM_UTILITY_VERSION"/sbom-utility-v"$SBOM_UTILITY_VERSION"-linux-amd64.tar.gz -O - | tar -zxf -
136137
wget --no-verbose https://github.com/CycloneDX/cyclonedx-cli/releases/download/v"$CYCLONE_DX_CLI_VERSION"/cyclonedx-linux-x64
137138
cp cyclonedx-linux-x64 /usr/local/bin/cyclonedx
138139
chmod +x /usr/local/bin/cyclonedx
140+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v"$TRIVY_VERSION"
139141
-
140142
name: Generate SBOM for backend application
141143
env:
@@ -145,7 +147,7 @@ jobs:
145147
run: |
146148
mv ../backend/poetry_requirements.txt ../backend/poetry_requirements.sic
147149
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_backend_application.json
148-
cdxgen ../backend --type python --required-only --profile license-compliance --no-auto-compositions --output sbom_backend_application.json
150+
cdxgen ../backend --type python --required-only --profile license-compliance --no-auto-compositions --output sbom_backend_application.json --spec-version 1.6
149151
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles --quiet --input-file sbom_backend_application.json \
150152
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
151153
| sbom-utility patch --patch-file ./configuration/patch_backend_application.json --quiet --input-file - --output-file sbom_backend_application_"$VERSION".json
@@ -159,7 +161,7 @@ jobs:
159161
working-directory: ./sbom
160162
run: |
161163
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_frontend_application.json
162-
cdxgen ../frontend --type npm --no-babel --required-only --profile license-compliance --no-auto-compositions --project-name secobserve --output sbom_frontend_application.json
164+
cdxgen ../frontend --type npm --no-babel --required-only --profile license-compliance --no-auto-compositions --project-name secobserve --output sbom_frontend_application.json --spec-version 1.6
163165
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles --quiet --input-file sbom_frontend_application.json \
164166
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
165167
| sbom-utility patch --patch-file ./configuration/patch_frontend_application.json --quiet --input-file - --output-file sbom_frontend_application_"$VERSION".json
@@ -172,7 +174,7 @@ jobs:
172174
working-directory: ./sbom
173175
run: |
174176
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_backend_container.json
175-
cdxgen maibornwolff/secobserve-backend:$VERSION --type container --exclude-type python --exclude-type ruby --profile license-compliance --no-auto-compositions --output sbom_backend_container.json
177+
trivy image --scanners license --pkg-types os --format cyclonedx --output sbom_backend_container.json maibornwolff/secobserve-backend:$VERSION
176178
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles,services --quiet --input-file sbom_backend_container.json \
177179
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
178180
| sbom-utility patch --patch-file ./configuration/patch_backend_container.json --quiet --input-file - --output-file sbom_backend_container_"$VERSION".json
@@ -185,7 +187,7 @@ jobs:
185187
working-directory: ./sbom
186188
run: |
187189
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_frontend_container.json
188-
cdxgen maibornwolff/secobserve-frontend:$VERSION --type container --exclude-type npm --exclude-type ruby --profile license-compliance --no-auto-compositions --output sbom_frontend_container.json
190+
trivy image --scanners license --pkg-types os --format cyclonedx --output sbom_frontend_container.json maibornwolff/secobserve-frontend:$VERSION
189191
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles,services --quiet --input-file sbom_frontend_container.json \
190192
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
191193
| sbom-utility patch --patch-file ./configuration/patch_frontend_container.json --quiet --input-file - --output-file sbom_frontend_container_"$VERSION".json
@@ -199,12 +201,13 @@ jobs:
199201
run: |
200202
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_complete.json
201203
cyclonedx merge --hierarchical --name "SecObserve" --version "$VERSION" --input-files sbom_backend_application_"$VERSION".json sbom_frontend_application_"$VERSION".json sbom_backend_container_"$VERSION".json sbom_frontend_container_"$VERSION".json --output-format json \
204+
| sbom-utility trim --keys=declarations,definitions --quiet --input-file - \
202205
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
203206
| sbom-utility patch --patch-file ./configuration/patch_complete.json --quiet --input-file - --output-file sbom_"$VERSION".json
204207
sbom-utility validate --input-file sbom_"$VERSION".json
205208
-
206209
name: Commit SBOMs
207-
uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
210+
uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
208211
with:
209212
skip_fetch: true
210213
create_branch: true

‎.github/workflows/check_backend.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
steps:
1515
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616
- name: Set up Python 3.12
17-
uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55 # v5.5.0
17+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
1818
with:
1919
python-version: 3.12
2020

‎.github/workflows/check_frontend.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
12-
- uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
12+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
1313
with:
1414
node-version: 20
1515

‎.github/workflows/check_licenses_dev.yml‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,44 +12,58 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
-
15-
uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0
15+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
1616
with:
1717
node-version: 20
1818
-
1919
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2020
-
2121
name: Install programs
2222
env:
23-
CDXGEN_VERSION: 10.10.6
23+
CDXGEN_VERSION: 11.2.3
2424
run: |
2525
npm install -g @cyclonedx/cdxgen@"$CDXGEN_VERSION"
2626
-
2727
name: Generate SBOM for backend application
2828
env:
2929
FETCH_LICENSE: 1
3030
run: |
31+
mv ./backend/poetry_requirements.txt ./backend/poetry_requirements.sic
3132
cdxgen ./backend --type python --required-only --profile license-compliance --no-auto-compositions --output sbom_backend_application.json
33+
mv ./backend/poetry_requirements.sic ./backend/poetry_requirements.txt
3234
-
3335
name: Generate SBOM for frontend application
3436
run: |
3537
cdxgen ./frontend --type npm --no-babel --required-only --profile license-compliance --no-auto-compositions --project-name secobserve --output sbom_frontend_application.json
3638
-
3739
name: Import backend SBOM
38-
uses: MaibornWolff/secobserve_actions_templates/actions/importer@2f7b500fde2de2bdea7eef3b6df5503c2476916f # main
40+
uses: MaibornWolff/secobserve_actions_templates/actions/upload_sbom@32595f58f393dbc99507c7ec574e47c3443808f1 # main
3941
with:
4042
so_product_name: 'SecObserve'
4143
so_file_name: 'sbom_backend_application.json'
42-
so_parser_name: 'CycloneDX'
4344
so_branch_name: 'dev'
4445
so_api_base_url: "https://secobserve-backend.maibornwolff.de"
4546
so_api_token: ${{ secrets.SO_API_TOKEN }}
4647
-
4748
name: Import frontend SBOM
48-
uses: MaibornWolff/secobserve_actions_templates/actions/importer@2f7b500fde2de2bdea7eef3b6df5503c2476916f # main
49+
uses: MaibornWolff/secobserve_actions_templates/actions/upload_sbom@32595f58f393dbc99507c7ec574e47c3443808f1 # main
4950
with:
5051
so_product_name: 'SecObserve'
5152
so_file_name: 'sbom_frontend_application.json'
52-
so_parser_name: 'CycloneDX'
5353
so_branch_name: 'dev'
5454
so_api_base_url: "https://secobserve-backend.maibornwolff.de"
5555
so_api_token: ${{ secrets.SO_API_TOKEN }}
56+
-
57+
name: Check licenses for backend application
58+
uses: MaibornWolff/purl-patrol@c11a9181b28143386d730aef6e1fed9aef51e2e6 # v1.6.1
59+
with:
60+
SBOM_PATH: 'sbom_backend_application.json'
61+
LICENSE_POLICY_PATH: 'sbom/configuration/license_policy.json'
62+
BREAK_ENABLED: false
63+
-
64+
name: Check licenses for frontend application
65+
uses: MaibornWolff/purl-patrol@c11a9181b28143386d730aef6e1fed9aef51e2e6 # v1.6.1
66+
with:
67+
SBOM_PATH: 'sbom_frontend_application.json'
68+
LICENSE_POLICY_PATH: 'sbom/configuration/license_policy.json'
69+
BREAK_ENABLED: false

‎.github/workflows/check_vulnerabilities.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,21 @@ permissions: read-all
66

77
jobs:
88
check_code_vulnerabilities:
9-
if: github.event.repository.url == 'https://github.com/MaibornWolff/SecObserve'
9+
if: github.repository == 'MaibornWolff/SecObserve'
1010
runs-on: ubuntu-latest
1111
steps:
1212
-
1313
name: Checkout code
1414
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1515
-
1616
name: Run vulnerability scanners for code
17-
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@2f7b500fde2de2bdea7eef3b6df5503c2476916f # main
17+
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@32595f58f393dbc99507c7ec574e47c3443808f1 # main
1818
with:
1919
so_configuration: 'so_configuration_code.yml'
2020
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}
2121

2222
check_code_sonarqube_backend:
23+
if: github.repository == 'MaibornWolff/SecObserve'
2324
runs-on: ubuntu-latest
2425
steps:
2526
-
@@ -29,13 +30,14 @@ jobs:
2930
fetch-depth: 0
3031
-
3132
name: Run SonarQube scan for backend
32-
uses: SonarSource/sonarqube-scan-action@v5
33+
uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
3334
env:
3435
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
3536
with:
3637
projectBaseDir: backend
3738

3839
check_code_sonarqube_frontend:
40+
if: github.repository == 'MaibornWolff/SecObserve'
3941
runs-on: ubuntu-latest
4042
steps:
4143
-
@@ -45,7 +47,7 @@ jobs:
4547
fetch-depth: 0
4648
-
4749
name: Run SonarQube scan for frontend
48-
uses: SonarSource/sonarqube-scan-action@v5
50+
uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
4951
env:
5052
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_FRONTEND }}
5153
with:

0 commit comments

Comments
 (0)