Skip to content

Commit 98211c7

Browse files
dervoetidervoeti
committed
Merge branch 'dev' of https://github.com/MaibornWolff/SecObserve into stackable
2 parents cde3c8c + 9e9fa91 commit 98211c7

File tree

313 files changed

+14906
-6750
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

313 files changed

+14906
-6750
lines changed

‎.github/workflows/build_push_dev.yml‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,18 @@ permissions:
99
id-token: write
1010

1111
jobs:
12-
docker:
12+
docker_backend_dev:
1313
runs-on: ubuntu-latest
1414
steps:
1515
-
1616
name: Checkout
1717
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1818
-
1919
name: Set up QEMU
20-
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
20+
uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
2121
-
2222
name: Set up Docker Buildx
23-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
23+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
2424
-
2525
name: Login to Stackable Harbor
2626
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
@@ -37,7 +37,7 @@ jobs:
3737
-
3838
name: Build and push backend
3939
id: build-and-push-backend
40-
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
40+
uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
4141
with:
4242
context: .
4343
file: ./docker/backend/prod/django/Dockerfile
@@ -47,13 +47,35 @@ jobs:
4747
CREATED=${{ env.CREATED }}
4848
REVISION=${{ github.sha }}
4949
VERSION=dev
50+
51+
docker_frontend_dev:
52+
runs-on: ubuntu-latest
53+
steps:
54+
-
55+
name: Checkout
56+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
57+
-
58+
name: Set up QEMU
59+
uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
60+
-
61+
name: Set up Docker Buildx
62+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
63+
-
64+
name: Login to Docker Hub
65+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
66+
with:
67+
username: ${{ secrets.DOCKERHUB_USERNAME }}
68+
password: ${{ secrets.DOCKERHUB_TOKEN }}
69+
-
70+
name: Set current date as env variable
71+
run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
5072
-
5173
name: Sign the published backend image
5274
run: cosign sign -y oci.stackable.tech/stackable/secobserve-backend@${{ steps.build-and-push-backend.outputs.digest }}
5375
-
5476
name: Build and push frontend
5577
id: build-and-push-frontend
56-
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
78+
uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
5779
with:
5880
context: .
5981
file: ./docker/frontend/prod/Dockerfile

‎.github/workflows/build_push_release.yml‎

Lines changed: 144 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ on:
1111
permissions: read-all
1212

1313
jobs:
14-
docker:
14+
docker_backend_release:
1515
runs-on: ubuntu-latest
1616
steps:
1717
-
@@ -21,10 +21,10 @@ jobs:
2121
ref: 'v${{ github.event.inputs.release }}'
2222
-
2323
name: Set up QEMU
24-
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
24+
uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
2525
-
2626
name: Set up Docker Buildx
27-
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
27+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
2828
-
2929
name: Login to Docker Hub
3030
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
@@ -36,7 +36,7 @@ jobs:
3636
run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
3737
-
3838
name: Build and push backend
39-
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
39+
uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
4040
with:
4141
context: .
4242
file: ./docker/backend/prod/django/Dockerfile
@@ -48,9 +48,33 @@ jobs:
4848
CREATED=${{ env.CREATED }}
4949
REVISION=${{ github.sha }}
5050
VERSION=${{ github.event.inputs.release }}
51+
52+
docker_frontend_release:
53+
runs-on: ubuntu-latest
54+
steps:
55+
-
56+
name: Checkout
57+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58+
with:
59+
ref: 'v${{ github.event.inputs.release }}'
60+
-
61+
name: Set up QEMU
62+
uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
63+
-
64+
name: Set up Docker Buildx
65+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
66+
-
67+
name: Login to Docker Hub
68+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
69+
with:
70+
username: ${{ secrets.DOCKERHUB_USERNAME }}
71+
password: ${{ secrets.DOCKERHUB_TOKEN }}
72+
-
73+
name: Set current date as env variable
74+
run: echo "CREATED=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_ENV
5175
-
5276
name: Build and push frontend
53-
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
77+
uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
5478
with:
5579
context: .
5680
file: ./docker/frontend/prod/Dockerfile
@@ -62,15 +86,128 @@ jobs:
6286
CREATED=${{ env.CREATED }}
6387
REVISION=${{ github.sha }}
6488
VERSION=${{ github.event.inputs.release }}
89+
90+
vulnerability_scans_release:
91+
runs-on: ubuntu-latest
92+
needs: [docker_backend_release, docker_frontend_release]
93+
steps:
94+
-
95+
name: Checkout
96+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
97+
with:
98+
ref: 'v${{ github.event.inputs.release }}'
6599
-
66100
name: Run vulnerability scanners for images
67-
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@5476f0de11c46875081d9767ec166c1e030e9ef0 # main
101+
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@a8344daa56598a80c2c80081974a0468dd29d086 # main
68102
with:
69103
so_configuration: 'so_configuration_sca_current.yml'
70104
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}
71105
-
72106
name: Run vulnerability scanners for endpoints
73-
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@5476f0de11c46875081d9767ec166c1e030e9ef0 # main
107+
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@a8344daa56598a80c2c80081974a0468dd29d086 # main
74108
with:
75109
so_configuration: 'so_configuration_endpoints.yml'
76110
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}
111+
112+
generate_sboms:
113+
runs-on: ubuntu-latest
114+
needs: [docker_backend_release, docker_frontend_release]
115+
permissions:
116+
contents: write
117+
steps:
118+
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
119+
with:
120+
node-version: 20
121+
-
122+
name: Checkout
123+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
124+
with:
125+
ref: 'v${{ github.event.inputs.release }}'
126+
-
127+
name: Install programs
128+
env:
129+
CDXGEN_VERSION: 10.9.4
130+
SBOM_UTILITY_VERSION: 0.16.0
131+
CYCLONE_DX_CLI_VERSION: 0.25.1
132+
run: |
133+
npm install -g @cyclonedx/cdxgen@"$CDXGEN_VERSION"
134+
cd /usr/local/bin
135+
wget --no-verbose https://github.com/CycloneDX/sbom-utility/releases/download/v"$SBOM_UTILITY_VERSION"/sbom-utility-v"$SBOM_UTILITY_VERSION"-linux-amd64.tar.gz -O - | tar -zxf -
136+
wget --no-verbose https://github.com/CycloneDX/cyclonedx-cli/releases/download/v"$CYCLONE_DX_CLI_VERSION"/cyclonedx-linux-x64
137+
cp cyclonedx-linux-x64 /usr/local/bin/cyclonedx
138+
chmod +x /usr/local/bin/cyclonedx
139+
-
140+
name: Generate SBOM for backend application
141+
env:
142+
VERSION: ${{ github.event.inputs.release }}
143+
FETCH_LICENSE: 1
144+
working-directory: ./sbom
145+
run: |
146+
mv ../backend/poetry_requirements.txt ../backend/poetry_requirements.sic
147+
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_backend_application.json
148+
cdxgen ../backend --type python --required-only --profile license-compliance --no-auto-compositions --output sbom_backend_application.json
149+
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles --quiet --input-file sbom_backend_application.json \
150+
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
151+
| sbom-utility patch --patch-file ./configuration/patch_backend_application.json --quiet --input-file - --output-file sbom_backend_application_"$VERSION".json
152+
sbom-utility validate --input-file sbom_backend_application_"$VERSION".json
153+
rm sbom_backend_application.json
154+
mv ../backend/poetry_requirements.sic ../backend/poetry_requirements.txt
155+
-
156+
name: Generate SBOM for frontend application
157+
env:
158+
VERSION: ${{ github.event.inputs.release }}
159+
working-directory: ./sbom
160+
run: |
161+
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_frontend_application.json
162+
cdxgen ../frontend --type npm --no-babel --required-only --profile license-compliance --no-auto-compositions --project-name secobserve --output sbom_frontend_application.json
163+
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles --quiet --input-file sbom_frontend_application.json \
164+
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
165+
| sbom-utility patch --patch-file ./configuration/patch_frontend_application.json --quiet --input-file - --output-file sbom_frontend_application_"$VERSION".json
166+
sbom-utility validate --input-file sbom_frontend_application_"$VERSION".json
167+
rm sbom_frontend_application.json
168+
-
169+
name: Generate SBOM for backend container
170+
env:
171+
VERSION: ${{ github.event.inputs.release }}
172+
working-directory: ./sbom
173+
run: |
174+
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_backend_container.json
175+
cdxgen maibornwolff/secobserve-backend:$VERSION --type container --exclude-type python --exclude-type ruby --profile license-compliance --no-auto-compositions --output sbom_backend_container.json
176+
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles,services --quiet --input-file sbom_backend_container.json \
177+
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
178+
| sbom-utility patch --patch-file ./configuration/patch_backend_container.json --quiet --input-file - --output-file sbom_backend_container_"$VERSION".json
179+
sbom-utility validate --input-file sbom_backend_container_"$VERSION".json
180+
rm sbom_backend_container.json
181+
-
182+
name: Generate SBOM for frontend container
183+
env:
184+
VERSION: ${{ github.event.inputs.release }}
185+
working-directory: ./sbom
186+
run: |
187+
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_frontend_container.json
188+
cdxgen maibornwolff/secobserve-frontend:$VERSION --type container --exclude-type npm --exclude-type ruby --profile license-compliance --no-auto-compositions --output sbom_frontend_container.json
189+
sbom-utility trim --keys=externalReferences,properties,evidence,authors,lifecycles,services --quiet --input-file sbom_frontend_container.json \
190+
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
191+
| sbom-utility patch --patch-file ./configuration/patch_frontend_container.json --quiet --input-file - --output-file sbom_frontend_container_"$VERSION".json
192+
sbom-utility validate --input-file sbom_frontend_container_"$VERSION".json
193+
rm sbom_frontend_container.json
194+
-
195+
name: Merge SBOMs
196+
env:
197+
VERSION: ${{ github.event.inputs.release }}
198+
working-directory: ./sbom
199+
run: |
200+
sed -i "s|REPLACE_VERSION|$VERSION|g" ./configuration/patch_complete.json
201+
cyclonedx merge --hierarchical --name "SecObserve" --version "$VERSION" --input-files sbom_backend_application_"$VERSION".json sbom_frontend_application_"$VERSION".json sbom_backend_container_"$VERSION".json sbom_frontend_container_"$VERSION".json --output-format json \
202+
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
203+
| sbom-utility patch --patch-file ./configuration/patch_complete.json --quiet --input-file - --output-file sbom_"$VERSION".json
204+
sbom-utility validate --input-file sbom_"$VERSION".json
205+
-
206+
name: Commit SBOMs
207+
uses: stefanzweifel/git-auto-commit-action@e348103e9026cc0eee72ae06630dbe30c8bf7a79 # v5
208+
with:
209+
skip_fetch: true
210+
create_branch: true
211+
commit_message: "chore: generate SBOMs for release ${{ github.event.inputs.release }}"
212+
branch: "chore/sboms_release_${{ github.event.inputs.release }}"
213+
file_pattern: "sbom/sbom*.json"

‎.github/workflows/check_backend.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,8 @@ env:
99
POETRY_NO_INTERACTION: 1
1010

1111
jobs:
12-
check_backend:
13-
12+
code_quality:
1413
runs-on: ubuntu-latest
15-
1614
steps:
1715
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1816
- name: Set up Python 3.12
@@ -57,6 +55,10 @@ jobs:
5755
run: |
5856
lint-imports --no-cache
5957
58+
unittests:
59+
runs-on: ubuntu-latest
60+
steps:
61+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6062
- name: Unittests
6163
run: |
6264
docker build -f docker/backend/unittests/django/Dockerfile -t secobserve_backend_unittests:latest .

‎.github/workflows/check_frontend.yml‎

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -5,36 +5,38 @@ on: [push, pull_request]
55
permissions: read-all
66

77
jobs:
8-
check_frontend:
9-
8+
code_quality:
109
runs-on: ubuntu-latest
11-
1210
steps:
13-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
14-
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
15-
with:
16-
node-version: 20
17-
18-
- name: Install dependencies
19-
working-directory: ./frontend
20-
run: |
21-
npm ci
22-
23-
- name: Prettier
24-
working-directory: ./frontend
25-
run: |
26-
npx prettier -c src
27-
28-
- name: ESLint
29-
working-directory: ./frontend
30-
run: |
31-
npx eslint src
32-
33-
- name: End-to-end tests
34-
working-directory: .
35-
run: |
36-
cd end_to_end_tests
37-
npm install
38-
cd ..
39-
docker compose -f docker-compose-playwright.yml build
40-
docker compose -f docker-compose-playwright.yml up --abort-on-container-exit --exit-code-from playwright
11+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
12+
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
13+
with:
14+
node-version: 20
15+
16+
- name: Install dependencies
17+
working-directory: ./frontend
18+
run: |
19+
npm ci
20+
21+
- name: Prettier
22+
working-directory: ./frontend
23+
run: |
24+
npx prettier -c src
25+
26+
- name: ESLint
27+
working-directory: ./frontend
28+
run: |
29+
npx eslint src
30+
31+
end_to_end_tests:
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
- name: End-to-end tests
36+
working-directory: .
37+
run: |
38+
cd end_to_end_tests
39+
npm install
40+
cd ..
41+
docker compose -f docker-compose-playwright.yml build
42+
docker compose -f docker-compose-playwright.yml up --abort-on-container-exit --exit-code-from playwright

‎.github/workflows/check_licenses_dev.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ permissions: read-all
1010
jobs:
1111
scan_licenses:
1212
runs-on: ubuntu-latest
13-
permissions:
14-
contents: write
1513
steps:
1614
-
1715
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
@@ -37,7 +35,7 @@ jobs:
3735
cdxgen ./frontend --type npm --no-babel --required-only --profile license-compliance --no-auto-compositions --project-name secobserve --output sbom_frontend_application.json
3836
-
3937
name: Import backend SBOM
40-
uses: MaibornWolff/secobserve_actions_templates/actions/importer@5476f0de11c46875081d9767ec166c1e030e9ef0 # main
38+
uses: MaibornWolff/secobserve_actions_templates/actions/importer@a8344daa56598a80c2c80081974a0468dd29d086 # main
4139
with:
4240
so_product_name: 'SecObserve'
4341
so_file_name: 'sbom_backend_application.json'
@@ -47,7 +45,7 @@ jobs:
4745
so_api_token: ${{ secrets.SO_API_TOKEN }}
4846
-
4947
name: Import frontend SBOM
50-
uses: MaibornWolff/secobserve_actions_templates/actions/importer@5476f0de11c46875081d9767ec166c1e030e9ef0 # main
48+
uses: MaibornWolff/secobserve_actions_templates/actions/importer@a8344daa56598a80c2c80081974a0468dd29d086 # main
5149
with:
5250
so_product_name: 'SecObserve'
5351
so_file_name: 'sbom_frontend_application.json'

‎.github/workflows/check_vulnerabilities.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1515
-
1616
name: Run vulnerability scanners for code
17-
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@5476f0de11c46875081d9767ec166c1e030e9ef0 # main
17+
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@a8344daa56598a80c2c80081974a0468dd29d086 # main
1818
with:
1919
so_configuration: 'so_configuration_code.yml'
2020
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}

0 commit comments

Comments
 (0)