Merge branch 'main' into deprecate/helm

Author: chosak

.github/workflows/build-docker.yml

@@ -0,0 +1,20 @@
+name: Build cf.gov Docker images
+
+on:
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+jobs:
+  build-docker-images:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build cfgov image
+        run: docker build -t cfgov:latest .
+
+      - name: Build cfgov-apache image
+        run: docker build -t cfgov-apache:latest cfgov/apache

.github/workflows/veracode.yml

@@ -0,0 +1,72 @@
+name: veracode
+on:
+  workflow_dispatch:
+  pull_request:
+  merge_group:
+jobs:
+  Veracode_SAST:
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+      - name: Zip Scannable Files
+        run: >
+          find . -path '*test*' -prune -o \( -name '*.py' -o -name '*.js' -o
+          -name '*.ts' -o -name '*.htm*' -o -name '*.json' -o -name '*.yml' \)
+          -print | zip cfgov-gha.zip -@
+      - name: See Included Files
+        run: |
+          ls -la
+      - name: Setup Veracode
+        run: |
+          curl -fsS https://tools.veracode.com/veracode-cli/install | sh
+      - name: Get baseline from private repo
+        run: |
+          gh api repos/cfpb/veracode-baselines/contents/cfgov/baseline.json \
+            --jq '.content' | base64 -d > baseline.json
+        env:
+          GH_TOKEN: ${{ secrets.VERACODE_PAT }}
+
+      - name: Download Veracode Static Pipeline Scanner
+        run: >
+          curl
+          https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
+          -o veracode.zip
+
+          unzip -o veracode.zip
+      - name: Verify No Secret Leak
+        continue-on-error: true
+        run: |
+          echo ${{secrets.VERACODE_API_ID}}
+      - name: Veracode Static Pipeline Scanner
+        continue-on-error: true
+        run: >
+          java -jar pipeline-scan.jar --veracode_api_id
+          "${{secrets.VERACODE_API_ID}}" --veracode_api_key
+          "${{secrets.VERACODE_API_KEY}}" --file
+          "./cfgov-gha.zip"  --baseline_file baseline.json --app_id="cfgov"
+          --fail_on_severity="Very High, High" --summary_output true
+
+      - name: Archive Results.json & Results.txt from Veracode Static Pipeline Scanner
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: Veracode SAST Pipeline Results
+          path: results.*
+  Veracode_SCA:
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4.2.2
+      - name: SCA Scan
+        env:
+          SRCCLR_API_TOKEN: ${{secrets.SRCCLR_API_TOKEN}}
+          SRCCLR_REGION: FED
+        working-directory: ./
+        run: >
+          curl -sSL https://download.sourceclear.com/ci.sh | sh -s scan
+          --json=SCA-App-Issues.json
+      - name: Upload SCA issues artifact
+        uses: actions/upload-artifact@v4.6.2
+        with:
+          name: Veracode SCA Scan Results
+          path: SCA-App-Issues.json