From 8e25d6e51f299ab5954036a6241c5392e485d0ab Mon Sep 17 00:00:00 2001 From: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> Date: Fri, 16 Jun 2023 13:46:47 +0200 Subject: [PATCH 1/5] Create SECURITY.md (#6) Vertrauen ist gut kontrolle ist besser --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..034e848 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are +currently being supported with security updates. + +| Version | Supported | +| ------- | ------------------ | +| 5.1.x | :white_check_mark: | +| 5.0.x | :x: | +| 4.0.x | :white_check_mark: | +| < 4.0 | :x: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +Tell them where to go, how often they can expect to get an update on a +reported vulnerability, what to expect if the vulnerability is accepted or +declined, etc. From a313bf1014b1520bce4503456c63e10884c5f662 Mon Sep 17 00:00:00 2001 From: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> Date: Tue, 26 Sep 2023 23:31:08 +0200 Subject: [PATCH 2/5] Update issue templates (#12) --- .github/ISSUE_TEMPLATE/bug_report.md | 4 ++-- .github/ISSUE_TEMPLATE/custom.md | 10 ++++++++++ .github/ISSUE_TEMPLATE/feature_request.md | 6 ++++-- 3 files changed, 16 insertions(+), 4 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/custom.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index aad6a0f..806211e 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -2,7 +2,7 @@ name: Bug report about: Create a bug report title: '' -labels: bug, needs triage +labels: bug assignees: '' --- @@ -35,4 +35,4 @@ A description with steps to reproduce the issue. If your have a public example o A description of what you expected to happen. **Actual behavior:** -A description of what is actually happening. \ No newline at end of file +A description of what is actually happening. diff --git a/.github/ISSUE_TEMPLATE/custom.md b/.github/ISSUE_TEMPLATE/custom.md new file mode 100644 index 0000000..48d5f81 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/custom.md @@ -0,0 +1,10 @@ +--- +name: Custom issue template +about: Describe this issue template's purpose here. +title: '' +labels: '' +assignees: '' + +--- + + diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md index 1c37027..df4b0cd 100644 --- a/.github/ISSUE_TEMPLATE/feature_request.md +++ b/.github/ISSUE_TEMPLATE/feature_request.md @@ -2,9 +2,11 @@ name: Feature request about: Suggest an idea for this project title: '' -labels: feature request, needs triage +labels: '' assignees: '' + --- + @@ -15,4 +17,4 @@ Describe your proposal. Justification or a use case for your proposal. **Are you willing to submit a PR?** - \ No newline at end of file + From cc50f188ae5f88d61501b210bb9cd24c7ffc94c3 Mon Sep 17 00:00:00 2001 From: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> Date: Tue, 30 Jan 2024 15:44:37 +0100 Subject: [PATCH 3/5] Dadudida Setup-Los (#13) * Create veracode.yml Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> * Create codeql.yml Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> --------- Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> --- .github/workflows/codeql.yml | 84 ++++++++++++++++++++++++++++++++++ .github/workflows/veracode.yml | 59 ++++++++++++++++++++++++ 2 files changed, 143 insertions(+) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/veracode.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..feca35a --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,84 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '20 14 * * 5' + +jobs: + analyze: + name: Analyze + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners + # Consider using larger runners for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} + permissions: + # required for all workflows + security-events: write + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + language: [ 'javascript-typescript' ] + # CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ] + # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v3 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/veracode.yml b/.github/workflows/veracode.yml new file mode 100644 index 0000000..9b3179e --- /dev/null +++ b/.github/workflows/veracode.yml @@ -0,0 +1,59 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert + +name: Veracode Static Analysis Pipeline Scan + +on: + push: + branches: [ "main" ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ "main" ] + schedule: + - cron: '36 18 * * 4' + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +permissions: + contents: read + +jobs: + # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter + build-and-pipeline-scan: + # The type of runner that the job will run on + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + runs-on: ubuntu-latest + steps: + + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps + - uses: actions/checkout@v3 + with: + repository: '' + + - run: zip -r veracode-scan-target.zip ./ + + # download the Veracode Static Analysis Pipeline scan jar + - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip + - run: unzip -o pipeline-scan-LATEST.zip + + - uses: actions/setup-java@v3 + with: + java-version: 8 + distribution: 'temurin' + - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-scan-target.zip + continue-on-error: true + - name: Convert pipeline scan output to SARIF format + id: convert + uses: veracode/veracode-pipeline-scan-results-to-sarif@ff08ae5b45d5384cb4679932f184c013d34da9be + with: + pipeline-results-json: results.json + - uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: veracode-results.sarif From f48fc8beebd7fba2dfd0f8ad3e1bbfd4a3e1afa0 Mon Sep 17 00:00:00 2001 From: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> Date: Sat, 3 Feb 2024 23:17:22 +0100 Subject: [PATCH 4/5] Setup-Los (#14) * Create veracode.yml Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> * Create codeql.yml Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> --------- Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> From 3d180a77789776ef33bee65d2e4d8dc01f52b42c Mon Sep 17 00:00:00 2001 From: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> Date: Sun, 3 Mar 2024 00:10:08 +0100 Subject: [PATCH 5/5] Setup-Los (#15) * Create veracode.yml Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> * Create codeql.yml Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com> --------- Signed-off-by: Sascha Ronnie Daoudia <85792632+Dadudidas@users.noreply.github.com>