Metro2/.github/workflows/veracode.yml at main · cfpb/Metro2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: veracode
on:
  workflow_dispatch:
  pull_request:
  merge_group:

jobs:
  Veracode_SAST:
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: Zip scannable files
        run: >
          find . -path '*test*' -prune -o \( -name '*.py' -o -name '*.js' -o
          -name '*.ts' -o -name '*.htm*' -o -name '*.json' -o -name '*.yml' \)
          -print | zip metro2-gha.zip -@

      - name: See included files
        run: |
          ls -la

      - name: Setup Veracode
        run: |
          curl -fsS https://tools.veracode.com/veracode-cli/install | sh

      - name: Download Veracode Static Pipeline Scanner
        run: >
          curl
          https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
          -o veracode.zip

          unzip -o veracode.zip

      - name: Veracode Static Pipeline Scanner
        env:
          VERACODE_API_ID: ${{ secrets.VERACODE_API_ID }}
          VERACODE_API_KEY: ${{ secrets.VERACODE_API_KEY }}
          VERACODE_POLICY: CFPB-Policy
        run: >
          java -jar pipeline-scan.jar
          --veracode_api_id "$VERACODE_API_ID"
          --veracode_api_key "$VERACODE_API_KEY"
          --request_policy "$VERACODE_POLICY"

          java -jar pipeline-scan.jar
          --veracode_api_id "$VERACODE_API_ID"
          --veracode_api_key "$VERACODE_API_KEY"
          --file "./metro2-gha.zip"
          --policy_file "$VERACODE_POLICY.json"
          --app_id="metro2"
          --summary_output true

  Veracode_SCA:
    runs-on:
      - ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Fetch Veracode
        run: curl -sSL https://download.sourceclear.com/ci.sh -o veracode.sh

      - name: SCA scan Django
        id: sca_backend
        continue-on-error: true
        env:
          SRCCLR_API_TOKEN: ${{secrets.SRCCLR_API_TOKEN}}
          SRCCLR_REGION: FED
        working-directory: ./django
        run: |
          set -o pipefail
          sh ../veracode.sh scan --json | tee ../sca_backend.json

      - name: SCA scan front-end
        id: sca_frontend
        continue-on-error: true
        env:
          SRCCLR_API_TOKEN: ${{secrets.SRCCLR_API_TOKEN}}
          SRCCLR_REGION: FED
        working-directory: ./front-end
        run: |
            set -o pipefail
            sh ../veracode.sh scan --json | tee ../sca_frontend.json

      - name: Report SCA results
        if: steps.sca_backend.outcome == 'failure' || steps.sca_frontend.outcome == 'failure'
        run: |
          echo "CVSS > 7.0 fails"
          echo "==== Django ===="
          jq -r '
            . as $root |
            [.records[0].vulnerabilities[]] |
            sort_by(-(.cvss3Score // .cvssScore // 0), .cve) |
            .[] |
            (.libraries[0]._links.ref | split("/") | map(select(. != "")) | map(tonumber? // .)) as $path |
            ($root | getpath($path[0:4])) as $lib |
            "- CVSS \(.cvss3Score // .cvssScore) [CVE \(.cve)] in `\($lib.name)@\($lib.versions[0].version)`: \(.title)  — affected \(.libraries[0].details[0].versionRange), fix: \(.libraries[0].details[0].updateToVersion // "none")"
          ' sca_backend.json
          echo "==== Front-end ===="
          jq -r '
            . as $root |
            [.records[0].vulnerabilities[]] |
            sort_by(-(.cvss3Score // .cvssScore // 0), .cve) |
            .[] |
            (.libraries[0]._links.ref | split("/") | map(select(. != "")) | map(tonumber? // .)) as $path |
            ($root | getpath($path[0:4])) as $lib |
            "- CVSS \(.cvss3Score // .cvssScore) [CVE \(.cve)] in `\($lib.name)@\($lib.versions[0].version)`: \(.title)  — affected \(.libraries[0].details[0].versionRange), fix: \(.libraries[0].details[0].updateToVersion // "none")"
          ' sca_frontend.json
          exit 1