Skip to content

Commit 8d608f0

Browse files
DemonsthereDemonsthere
authored
Merge pull request #7 from ory/ci/security-scanning
ci: adding security scans
2 parents a198264 + 2bfb206 commit 8d608f0

File tree

13 files changed

+272
-9
lines changed

13 files changed

+272
-9
lines changed

‎.deps/gitleaks.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# renovate: datasource=github-releases depName=gitleaks/gitleaks
2+
version: 8.21.2
3+
url: https://github.com/gitleaks/gitleaks/releases/download/v{{.Version}}/gitleaks_{{.Version}}_{{.Os}}_{{.Architecture}}.tar.gz
4+
mappings:
5+
architecture:
6+
amd64: x64
7+
arm64: arm64
8+
os:
9+
darwin: darwin
10+
linux: linux

‎.deps/go-licenses.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# renovate: datasource=github-releases depName=google/go-licenses extractVersion=^v(?<version>.*)$
2+
version: v1.6.0
3+
url: "{{.Version}}"

‎.deps/golangci-lint.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# renovate: datasource=github-releases depName=golangci/golangci-lint
2+
version: v2.8.0
3+
url: "{{.Version}}"

‎.deps/gosec.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# renovate: datasource=github-releases depName=securego/gosec
2+
version: 2.22.0
3+
url: https://github.com/securego/gosec/releases/download/v{{.Version}}/gosec_{{.Version}}_{{.Os}}_{{.Architecture}}.tar.gz
4+
mappings:
5+
architecture:
6+
amd64: amd64
7+
arm64: arm64
8+
os:
9+
darwin: darwin
10+
linux: linux

‎.deps/govulncheck.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# renovate: datasource=go depName=golang.org/x/vuln/cmd/govulncheck
2+
version: v1.1.4
3+
url: "{{.Version}}"

‎.deps/tfplugindocs.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# renovate: datasource=github-releases depName=hashicorp/terraform-plugin-docs
2+
version: 0.24.0
3+
url: https://github.com/hashicorp/terraform-plugin-docs/releases/download/v{{.Version}}/tfplugindocs_{{.Version}}_{{.Os}}_{{.Architecture}}.zip
4+
mappings:
5+
architecture:
6+
amd64: amd64
7+
arm64: arm64
8+
os:
9+
darwin: darwin
10+
linux: linux

‎.deps/trivy.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# renovate: datasource=github-releases depName=aquasecurity/trivy
2+
version: 0.58.0
3+
url: https://github.com/aquasecurity/trivy/releases/download/v{{.Version}}/trivy_{{.Version}}_{{.Os}}-{{.Architecture}}.tar.gz
4+
mappings:
5+
architecture:
6+
amd64: 64bit
7+
arm64: ARM64
8+
os:
9+
darwin: macOS
10+
linux: Linux

‎.github/workflows/security.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: Security
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '26 21 * * 3'
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
# Static Application Security Testing (SAST) - gosec
16+
gosec:
17+
name: Go Security Check
18+
runs-on: ubuntu-slim
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
23+
- name: Setup Go
24+
uses: actions/setup-go@v5
25+
with:
26+
go-version-file: 'go.mod'
27+
cache: true
28+
29+
- name: Run gosec
30+
run: make sec-gosec
31+
32+
# Software Composition Analysis (SCA) - Go vulnerability check
33+
govulncheck:
34+
name: Go Vulnerability Check
35+
runs-on: ubuntu-slim
36+
steps:
37+
- name: Checkout
38+
uses: actions/checkout@v4
39+
40+
- name: Setup Go
41+
uses: actions/setup-go@v5
42+
with:
43+
go-version-file: 'go.mod'
44+
cache: true
45+
46+
- name: Run govulncheck
47+
run: make sec-vuln
48+
49+
# Secret scanning - Gitleaks
50+
gitleaks:
51+
name: Secret Scanning
52+
runs-on: ubuntu-slim
53+
steps:
54+
- name: Checkout
55+
uses: actions/checkout@v4
56+
with:
57+
fetch-depth: 0
58+
59+
- name: Setup Go
60+
uses: actions/setup-go@v5
61+
with:
62+
go-version-file: 'go.mod'
63+
cache: true
64+
65+
- name: Run Gitleaks
66+
run: make sec-gitleaks
67+
68+
# Binary artifact scanning - Trivy on built binary
69+
trivy:
70+
name: Binary Vulnerability Scan
71+
runs-on: ubuntu-slim
72+
steps:
73+
- name: Checkout
74+
uses: actions/checkout@v4
75+
76+
- name: Setup Go
77+
uses: actions/setup-go@v5
78+
with:
79+
go-version-file: 'go.mod'
80+
cache: true
81+
82+
- name: Run Trivy
83+
run: make sec-trivy
84+
85+
# Dependency license compliance
86+
licenses:
87+
name: License Check
88+
runs-on: ubuntu-slim
89+
steps:
90+
- name: Checkout
91+
uses: actions/checkout@v4
92+
93+
- name: Setup Go
94+
uses: actions/setup-go@v5
95+
with:
96+
go-version-file: 'go.mod'
97+
cache: true
98+
99+
- name: Check licenses
100+
run: make licenses

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ terraform-provider-orynetwork
55
*.so
66
*.dylib
77

8-
# Tool binaries (installed by Makefile)
8+
# Local tool binaries (managed by Makefile)
99
.bin/
1010

1111
# Test binary

‎Makefile‎

Lines changed: 105 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,20 @@
1111
# ORY_CONSOLE_API_URL - Console API URL (default: https://api.console.ory.sh)
1212
# ORY_PROJECT_API_URL - Project API URL template (default: https://%s.projects.oryapis.com)
1313

14+
SHELL := /bin/bash -o pipefail
1415
BINARY_NAME := terraform-provider-orynetwork
1516
INSTALL_DIR := ~/.terraform.d/plugins/registry.terraform.io/ory/orynetwork/0.0.1/$(shell go env GOOS)_$(shell go env GOARCH)
1617

18+
# Platform detection for tool downloads
19+
OS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
20+
ARCH := $(shell uname -m)
21+
ifeq ($(ARCH),x86_64)
22+
ARCH := amd64
23+
endif
24+
ifeq ($(ARCH),aarch64)
25+
ARCH := arm64
26+
endif
27+
1728
.PHONY: help
1829
help: ## Show this help
1930
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
@@ -34,6 +45,12 @@ deps-ci: ## Install dependencies for CI environment
3445
@echo "Installing jq..."
3546
@if command -v apt-get >/dev/null 2>&1; then sudo apt-get update && sudo apt-get install -y jq; fi
3647

48+
# Ory CLI for dependency management
49+
.bin/ory:
50+
@mkdir -p .bin
51+
@curl --retry 7 --retry-connrefused -sSfL https://raw.githubusercontent.com/ory/meta/master/install.sh | bash -s -- -d -b .bin ory v0.3.4
52+
@touch -a -m .bin/ory
53+
3754
# ==============================================================================
3855
# BUILD
3956
# ==============================================================================
@@ -55,20 +72,51 @@ clean: ## Remove build artifacts
5572
# CODE QUALITY
5673
# ==============================================================================
5774

75+
# Code quality tool binaries
76+
.bin/golangci-lint: .deps/golangci-lint.yaml .bin/ory
77+
@VERSION=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/golangci-lint.yaml); \
78+
echo "Installing golangci-lint $${VERSION}..."; \
79+
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b .bin $${VERSION}
80+
81+
.bin/tfplugindocs: .deps/tfplugindocs.yaml .bin/ory
82+
@mkdir -p .bin
83+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/tfplugindocs.yaml); \
84+
echo "Downloading tfplugindocs from $${URL}..."; \
85+
curl -sSfL "$${URL}" -o /tmp/tfplugindocs.zip; \
86+
unzip -q -o /tmp/tfplugindocs.zip -d .bin tfplugindocs; \
87+
rm /tmp/tfplugindocs.zip; \
88+
chmod +x .bin/tfplugindocs
89+
90+
.bin/go-licenses: .deps/go-licenses.yaml .bin/ory
91+
@VERSION=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/go-licenses.yaml); \
92+
echo "Installing go-licenses $${VERSION}..."; \
93+
GOBIN=$(PWD)/.bin go install github.com/google/go-licenses@$${VERSION}
94+
5895
.PHONY: format
59-
format: ## Format all code (Go, Terraform, modules, docs, lint fixes)
96+
format: .bin/tfplugindocs .bin/golangci-lint ## Format all code (Go, Terraform, modules, docs, lint fixes)
6097
go fmt ./...
6198
gofmt -s -w .
6299
terraform fmt -recursive examples/
63100
go mod tidy
64-
@command -v tfplugindocs >/dev/null 2>&1 || { echo "Installing tfplugindocs..."; go install github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs@latest; }
65-
tfplugindocs generate --provider-name ory
66-
@command -v golangci-lint >/dev/null 2>&1 || { echo "Installing golangci-lint v2..."; go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest; }
67-
golangci-lint run --fix ./...
101+
.bin/tfplugindocs generate --provider-name ory
102+
.bin/golangci-lint run --fix ./...
68103

69104
.PHONY: lint
70-
lint: ## Run Go linter (without fixes)
71-
golangci-lint run ./...
105+
lint: .bin/golangci-lint ## Run Go linter (without fixes)
106+
.bin/golangci-lint run ./...
107+
108+
.PHONY: licenses
109+
licenses: .bin/go-licenses ## Check dependency licenses
110+
@# go-licenses has known issues with Go 1.25+ stdlib packages (github.com/google/go-licenses/issues/128)
111+
@# Suppress stderr noise about stdlib, but fail if disallowed licenses are found (exit code 3)
112+
@.bin/go-licenses check ./... --disallowed_types=forbidden,restricted 2>/dev/null; \
113+
EXIT_CODE=$$?; \
114+
if [ $$EXIT_CODE -eq 3 ]; then \
115+
echo "ERROR: Disallowed licenses found!"; \
116+
.bin/go-licenses check ./... --disallowed_types=forbidden,restricted; \
117+
exit 1; \
118+
fi; \
119+
echo "License check passed"
72120

73121
# ==============================================================================
74122
# TESTING
@@ -106,6 +154,56 @@ test-acc-all: env-check ## Run all acceptance tests including optional ones
106154
ORY_SCHEMA_TESTS_ENABLED=true \
107155
./scripts/run-acceptance-tests.sh -p 1 -v -timeout 30m ./...
108156

157+
# ==============================================================================
158+
# SECURITY SCANNING
159+
# ==============================================================================
160+
161+
.PHONY: sec
162+
sec: sec-vuln sec-gosec sec-gitleaks ## Run all security scans
163+
164+
# Security tool binaries
165+
.bin/govulncheck: .deps/govulncheck.yaml .bin/ory
166+
@VERSION=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/govulncheck.yaml); \
167+
echo "Installing govulncheck $${VERSION}..."; \
168+
GOBIN=$(PWD)/.bin go install golang.org/x/vuln/cmd/govulncheck@$${VERSION}
169+
170+
.bin/gosec: .deps/gosec.yaml .bin/ory
171+
@mkdir -p .bin
172+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/gosec.yaml); \
173+
echo "Downloading gosec from $${URL}..."; \
174+
curl -sSfL "$${URL}" | tar -xz -C .bin gosec; \
175+
chmod +x .bin/gosec
176+
177+
.bin/gitleaks: .deps/gitleaks.yaml .bin/ory
178+
@mkdir -p .bin
179+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/gitleaks.yaml); \
180+
echo "Downloading gitleaks from $${URL}..."; \
181+
curl -sSfL "$${URL}" | tar -xz -C .bin gitleaks; \
182+
chmod +x .bin/gitleaks
183+
184+
.bin/trivy: .deps/trivy.yaml .bin/ory
185+
@mkdir -p .bin
186+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/trivy.yaml); \
187+
echo "Downloading trivy from $${URL}..."; \
188+
curl -sSfL "$${URL}" | tar -xz -C .bin trivy; \
189+
chmod +x .bin/trivy
190+
191+
.PHONY: sec-vuln
192+
sec-vuln: .bin/govulncheck ## Run govulncheck for Go vulnerability scanning
193+
.bin/govulncheck ./...
194+
195+
.PHONY: sec-gosec
196+
sec-gosec: .bin/gosec ## Run gosec for Go security analysis
197+
.bin/gosec ./...
198+
199+
.PHONY: sec-gitleaks
200+
sec-gitleaks: .bin/gitleaks ## Run gitleaks for secret detection
201+
.bin/gitleaks detect --source . --verbose
202+
203+
.PHONY: sec-trivy
204+
sec-trivy: .bin/trivy build ## Run trivy vulnerability scan on built binary
205+
.bin/trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH .
206+
109207
# ==============================================================================
110208
# ENVIRONMENT HELPERS
111209
# ==============================================================================

0 commit comments

Comments
 (0)