Merge pull request #2 from johnfosborneiii/main

adding sts and sarif gen

Author: johnfosborneiii

.github/chainguard/scan-malware.sts.yaml

@@ -0,0 +1,15 @@
+# Copyright 2024 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: repo:chainguard-dev/libraries-malcontent-demo:.*
+claim_pattern:
+  job_workflow_ref: chainguard-dev/libraries-malcontent-demo/.github/workflows/scan-malware.yaml@.*
+
+permissions:
+  contents: write
+  pull_requests: write
+  workflows: write
+  security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+  packages: write
+  id-token: write

.github/workflows/generate-sarif.yaml

@@ -0,0 +1,48 @@
+name: generate-sarif-malware-report
+
+on:
+  workflow_dispatch:
+
+jobs:
+  scan-python-malware:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      security-events: write
+      contents: write
+      packages: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: pip install --no-cache-dir --upgrade pip
+
+      - name: Run SARIF conversion
+        run: python generate-malcontent-sarif.py
+
+      - name: Upload SARIF to GitHub
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: scans/malcontent-report.sarif
+
+      - name: Commit and push updated SARIF file
+        run: |
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          git add scans/malcontent-report.sarif
+          if git diff --cached --quiet; then
+            echo "No changes to commit."
+          else
+            git commit -m "Update malware diff SARIF Report: v8.3.40 → v8.3.41"
+            git push origin "${GITHUB_REF#refs/heads/}"

README.md

@@ -1 +1,3 @@
-# libraries-malcontent-demo
+# libraries-malcontent-demo
+
+gh extension install https://github.com/mario-campos/gh-code-scanning

generate-malcontent-sarif.py

@@ -3,9 +3,9 @@
 from pathlib import Path
 
 # === CONFIGURATION ===
-input_path = "ultralytics-malcontent-diff-v8.3.40-v8.3.41.json"
+input_path = Path("scans/ultralytics-malcontent-diff-v8.3.40-v8.3.41.json")
 sub_repo_path = "malcontent-samples/python/2024.ultralytics/v8.3.41"
-output_path = "scans/malcontent-report.sarif"
+output_path = Path("scans/malcontent-report.sarif")
 
 # === DETERMINE LOCAL REPO ROOT ===
 local_repo_root = Path.cwd() / sub_repo_path