146 lines
2.9 KiB
Bash
Executable File
146 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
set -u
|
|
|
|
echo "============================"
|
|
echo " Davidson CI - Security"
|
|
echo "============================"
|
|
|
|
FAIL=0
|
|
|
|
set_env() {
|
|
echo "$1=$2" >> "${GITHUB_ENV:-/dev/null}"
|
|
}
|
|
|
|
# Default states
|
|
set_env "DAVIDSON_COMPOSER_AUDIT" "SKIP"
|
|
set_env "DAVIDSON_NPM_AUDIT" "SKIP"
|
|
set_env "DAVIDSON_SEMGREP" "SKIP"
|
|
set_env "DAVIDSON_TRIVY_VULN" "SKIP"
|
|
set_env "DAVIDSON_TRIVY_SECRET" "SKIP"
|
|
|
|
# -------------------------
|
|
# Composer audit
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Composer security audit"
|
|
|
|
if [ -f composer.lock ]; then
|
|
if composer audit; then
|
|
set_env "DAVIDSON_COMPOSER_AUDIT" "PASS"
|
|
else
|
|
set_env "DAVIDSON_COMPOSER_AUDIT" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
else
|
|
echo "No composer.lock - skipping"
|
|
fi
|
|
|
|
# -------------------------
|
|
# npm audit
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ npm security audit"
|
|
|
|
if [ -f package-lock.json ]; then
|
|
if npm audit --audit-level=high; then
|
|
set_env "DAVIDSON_NPM_AUDIT" "PASS"
|
|
else
|
|
set_env "DAVIDSON_NPM_AUDIT" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
else
|
|
echo "No package-lock.json - skipping"
|
|
fi
|
|
|
|
# -------------------------
|
|
# Semgrep
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Semgrep"
|
|
|
|
if semgrep scan \
|
|
--config=p/security-audit \
|
|
--config=.davidson-ci/semgrep/davidson.yml \
|
|
--error \
|
|
--exclude=node_modules \
|
|
--exclude=vendor \
|
|
--exclude=.davidson-ci \
|
|
--exclude=.davidson-reports \
|
|
.
|
|
then
|
|
set_env "DAVIDSON_SEMGREP" "PASS"
|
|
else
|
|
set_env "DAVIDSON_SEMGREP" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
|
|
# -------------------------
|
|
# Trivy vulnerabilities
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Trivy vulnerabilities"
|
|
|
|
TRIVY_VULN_LOG="$(mktemp)"
|
|
|
|
if trivy fs \
|
|
--scanners vuln \
|
|
--severity HIGH,CRITICAL \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
--skip-dirs .davidson-ci \
|
|
--skip-dirs .davidson-reports \
|
|
. 2>&1 | tee "$TRIVY_VULN_LOG"; [ "${PIPESTATUS[0]}" -eq 0 ]
|
|
then
|
|
# Trivy exits 0 when the repository has nothing it can scan.
|
|
if grep -q "Supported files for scanner(s) not found" "$TRIVY_VULN_LOG"; then
|
|
echo "No dependency files to scan - skipping"
|
|
else
|
|
set_env "DAVIDSON_TRIVY_VULN" "PASS"
|
|
fi
|
|
else
|
|
set_env "DAVIDSON_TRIVY_VULN" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
|
|
# -------------------------
|
|
# Trivy secrets
|
|
# -------------------------
|
|
|
|
echo
|
|
echo "→ Trivy secrets"
|
|
|
|
if trivy fs \
|
|
--scanners secret \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
--skip-dirs .davidson-ci \
|
|
--skip-dirs .davidson-reports \
|
|
.
|
|
then
|
|
set_env "DAVIDSON_TRIVY_SECRET" "PASS"
|
|
else
|
|
set_env "DAVIDSON_TRIVY_SECRET" "FAIL"
|
|
FAIL=1
|
|
fi
|
|
|
|
# -------------------------
|
|
# Overall result
|
|
# -------------------------
|
|
|
|
if [ "$FAIL" -eq 0 ]; then
|
|
set_env "DAVIDSON_SECURITY_STATUS" "PASS"
|
|
|
|
echo
|
|
echo "Security module completed successfully"
|
|
exit 0
|
|
else
|
|
set_env "DAVIDSON_SECURITY_STATUS" "FAIL"
|
|
|
|
echo
|
|
echo "Security module found issues"
|
|
exit 1
|
|
fi |