133 lines
2.4 KiB
Bash
Executable File
133 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
set -u
|
|
|
|
echo "============================"
|
|
echo " Davidson CI - Security"
|
|
echo "============================"
|
|
|
|
FAIL=0
|
|
|
|
set_env() {
|
|
echo "$1=$2" >> "${GITHUB_ENV:-/dev/null}"
|
|
}
|
|
|
|
# Default states
|
|
set_env "DAVIDSON_COMPOSER_AUDIT" "SKIP"
|
|
set_env "DAVIDSON_NPM_AUDIT" "SKIP"
|
|
set_env "DAVIDSON_SEMGREP" "SKIP"
|
|
set_env "DAVIDSON_TRIVY_VULN" "SKIP"
|
|
set_env "DAVIDSON_TRIVY_SECRET" "SKIP"
|
|
|
|
# -------------------------
|
|
# Composer audit
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Composer security audit"
|
|
|
|
if [ -f composer.lock ]; then
|
|
if composer audit; then
|
|
set_env "DAVIDSON_COMPOSER_AUDIT" "PASS"
|
|
else
|
|
set_env "DAVIDSON_COMPOSER_AUDIT" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
else
|
|
echo "No composer.lock - skipping"
|
|
fi
|
|
|
|
# -------------------------
|
|
# npm audit
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ npm security audit"
|
|
|
|
if [ -f package-lock.json ]; then
|
|
if npm audit --audit-level=high; then
|
|
set_env "DAVIDSON_NPM_AUDIT" "PASS"
|
|
else
|
|
set_env "DAVIDSON_NPM_AUDIT" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
else
|
|
echo "No package-lock.json - skipping"
|
|
fi
|
|
|
|
# -------------------------
|
|
# Semgrep
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Semgrep"
|
|
|
|
if semgrep scan \
|
|
--config=p/security-audit \
|
|
--config=.davidson-ci/semgrep/davidson.yml \
|
|
--error \
|
|
--exclude=node_modules \
|
|
--exclude=vendor \
|
|
.
|
|
then
|
|
set_env "DAVIDSON_SEMGREP" "PASS"
|
|
else
|
|
set_env "DAVIDSON_SEMGREP" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
|
|
# -------------------------
|
|
# Trivy vulnerabilities
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Trivy vulnerabilities"
|
|
|
|
if trivy fs \
|
|
--scanners vuln \
|
|
--severity HIGH,CRITICAL \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
.
|
|
then
|
|
set_env "DAVIDSON_TRIVY_VULN" "PASS"
|
|
else
|
|
set_env "DAVIDSON_TRIVY_VULN" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
|
|
# -------------------------
|
|
# Trivy secrets
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Trivy secrets"
|
|
|
|
if trivy fs \
|
|
--scanners secret \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
.
|
|
then
|
|
set_env "DAVIDSON_TRIVY_SECRET" "PASS"
|
|
else
|
|
set_env "DAVIDSON_TRIVY_SECRET" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
|
|
# -------------------------
|
|
# Overall result
|
|
# -------------------------
|
|
|
|
if [ "$FAIL" -eq 0 ]; then
|
|
set_env "DAVIDSON_SECURITY_STATUS" "PASS"
|
|
|
|
echo
|
|
echo "Security module completed successfully"
|
|
exit 0
|
|
else
|
|
set_env "DAVIDSON_SECURITY_STATUS" "FAIL"
|
|
|
|
echo
|
|
echo "Security module found issues"
|
|
exit 1
|
|
fi |