Skip to content

Commit d6d5fea

Browse files
KT-DoanKT-Doan
committed
updated to add .deps
1 parent 47cedfa commit d6d5fea

File tree

7 files changed

+89
-43
lines changed

7 files changed

+89
-43
lines changed

‎.deps/gitleaks.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 8.21.2
2+
url: https://github.com/gitleaks/gitleaks/releases/download/v{{.Version}}/gitleaks_{{.Version}}_{{.Os}}_{{.Architecture}}.tar.gz
3+
mappings:
4+
architecture:
5+
amd64: x64
6+
arm64: arm64
7+
os:
8+
darwin: darwin
9+
linux: linux

‎.deps/gosec.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 2.22.0
2+
url: https://github.com/securego/gosec/releases/download/v{{.Version}}/gosec_{{.Version}}_{{.Os}}_{{.Architecture}}.tar.gz
3+
mappings:
4+
architecture:
5+
amd64: amd64
6+
arm64: arm64
7+
os:
8+
darwin: darwin
9+
linux: linux

‎.deps/govulncheck.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version: v1.1.4
2+
# govulncheck is installed via go install
3+
url: "{{.Version}}"

‎.deps/trivy.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 0.58.0
2+
url: https://github.com/aquasecurity/trivy/releases/download/v{{.Version}}/trivy_{{.Version}}_{{.Os}}-{{.Architecture}}.tar.gz
3+
mappings:
4+
architecture:
5+
amd64: 64bit
6+
arm64: ARM64
7+
os:
8+
darwin: macOS
9+
linux: Linux

‎.github/workflows/security.yml‎

Lines changed: 5 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,8 @@ jobs:
2626
go-version-file: 'go.mod'
2727
cache: true
2828

29-
- name: Install gosec
30-
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
31-
3229
- name: Run gosec
33-
run: gosec ./...
30+
run: make sec-gosec
3431

3532
# Software Composition Analysis (SCA) - Go vulnerability check
3633
govulncheck:
@@ -46,11 +43,8 @@ jobs:
4643
go-version-file: 'go.mod'
4744
cache: true
4845

49-
- name: Install govulncheck
50-
run: go install golang.org/x/vuln/cmd/govulncheck@latest
51-
5246
- name: Run govulncheck
53-
run: govulncheck ./...
47+
run: make sec-vuln
5448

5549
# Secret scanning - Gitleaks
5650
gitleaks:
@@ -62,14 +56,8 @@ jobs:
6256
with:
6357
fetch-depth: 0
6458

65-
- name: Install gitleaks
66-
run: |
67-
GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name | cut -d '"' -f 4 | sed 's/v//')
68-
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz
69-
sudo mv gitleaks /usr/local/bin/
70-
7159
- name: Run Gitleaks
72-
run: gitleaks detect --source . --verbose
60+
run: make sec-gitleaks
7361

7462
# Binary artifact scanning - Trivy on built binary
7563
trivy:
@@ -85,22 +73,8 @@ jobs:
8573
go-version-file: 'go.mod'
8674
cache: true
8775

88-
- name: Build binary
89-
run: go build -o terraform-provider-orynetwork .
90-
91-
- name: Run Trivy filesystem scan
92-
uses: aquasecurity/trivy-action@master
93-
with:
94-
scan-type: 'fs'
95-
scan-ref: '.'
96-
format: 'table'
97-
exit-code: '1'
98-
severity: 'CRITICAL,HIGH'
99-
scanners: 'vuln,secret,misconfig'
100-
ignore-unfixed: true
101-
env:
102-
TRIVY_SKIP_JAVA_DB_UPDATE: 'true'
103-
TRIVY_DISABLE_VEX_NOTICE: 'true'
76+
- name: Run Trivy
77+
run: make sec-trivy
10478

10579
# Dependency license compliance
10680
licenses:

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ terraform-provider-orynetwork
55
*.so
66
*.dylib
77

8+
# Local tool binaries (managed by Makefile)
9+
.bin/
10+
811
# Test binary
912
*.test
1013

‎Makefile‎

Lines changed: 51 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,16 @@
1414
BINARY_NAME := terraform-provider-orynetwork
1515
INSTALL_DIR := ~/.terraform.d/plugins/registry.terraform.io/ory/orynetwork/0.0.1/$(shell go env GOOS)_$(shell go env GOARCH)
1616

17+
# Platform detection for tool downloads
18+
OS := $(shell uname -s | tr '[:upper:]' '[:lower:]')
19+
ARCH := $(shell uname -m)
20+
ifeq ($(ARCH),x86_64)
21+
ARCH := amd64
22+
endif
23+
ifeq ($(ARCH),aarch64)
24+
ARCH := arm64
25+
endif
26+
1727
.PHONY: help
1828
help: ## Show this help
1929
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
@@ -34,6 +44,12 @@ deps-ci: ## Install dependencies for CI environment
3444
@echo "Installing jq..."
3545
@if command -v apt-get >/dev/null 2>&1; then sudo apt-get update && sudo apt-get install -y jq; fi
3646

47+
# Ory CLI for dependency management
48+
.bin/ory:
49+
@mkdir -p .bin
50+
@bash <(curl --retry 7 --retry-connrefused https://raw.githubusercontent.com/ory/meta/master/install.sh) -d -b .bin ory v0.3.4
51+
@touch -a -m .bin/ory
52+
3753
# ==============================================================================
3854
# BUILD
3955
# ==============================================================================
@@ -113,25 +129,48 @@ test-acc-all: env-check ## Run all acceptance tests including optional ones
113129
.PHONY: sec
114130
sec: sec-vuln sec-gosec sec-gitleaks ## Run all security scans
115131

132+
# Security tool binaries
133+
.bin/govulncheck: .deps/govulncheck.yaml .bin/ory
134+
@VERSION=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/govulncheck.yaml); \
135+
echo "Installing govulncheck $${VERSION}..."; \
136+
GOBIN=$(PWD)/.bin go install golang.org/x/vuln/cmd/govulncheck@$${VERSION}
137+
138+
.bin/gosec: .deps/gosec.yaml .bin/ory
139+
@mkdir -p .bin
140+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/gosec.yaml); \
141+
echo "Downloading gosec from $${URL}..."; \
142+
curl -sSfL "$${URL}" | tar -xz -C .bin gosec; \
143+
chmod +x .bin/gosec
144+
145+
.bin/gitleaks: .deps/gitleaks.yaml .bin/ory
146+
@mkdir -p .bin
147+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/gitleaks.yaml); \
148+
echo "Downloading gitleaks from $${URL}..."; \
149+
curl -sSfL "$${URL}" | tar -xz -C .bin gitleaks; \
150+
chmod +x .bin/gitleaks
151+
152+
.bin/trivy: .deps/trivy.yaml .bin/ory
153+
@mkdir -p .bin
154+
@URL=$$(.bin/ory dev ci deps url -o $(OS) -a $(ARCH) -c .deps/trivy.yaml); \
155+
echo "Downloading trivy from $${URL}..."; \
156+
curl -sSfL "$${URL}" | tar -xz -C .bin trivy; \
157+
chmod +x .bin/trivy
158+
116159
.PHONY: sec-vuln
117-
sec-vuln: ## Run govulncheck for Go vulnerability scanning
118-
@command -v govulncheck >/dev/null 2>&1 || { echo "Installing govulncheck..."; go install golang.org/x/vuln/cmd/govulncheck@latest; }
119-
govulncheck ./...
160+
sec-vuln: .bin/govulncheck ## Run govulncheck for Go vulnerability scanning
161+
.bin/govulncheck ./...
120162

121163
.PHONY: sec-gosec
122-
sec-gosec: ## Run gosec for Go security analysis
123-
@command -v gosec >/dev/null 2>&1 || { echo "Installing gosec..."; go install github.com/securego/gosec/v2/cmd/gosec@latest; }
124-
gosec ./...
164+
sec-gosec: .bin/gosec ## Run gosec for Go security analysis
165+
.bin/gosec ./...
125166

126167
.PHONY: sec-gitleaks
127-
sec-gitleaks: ## Run gitleaks for secret detection
128-
@command -v gitleaks >/dev/null 2>&1 || { echo "gitleaks not found. Install: brew install gitleaks (macOS) or download from https://github.com/gitleaks/gitleaks/releases"; exit 1; }
129-
gitleaks detect --source . --verbose
168+
sec-gitleaks: .bin/gitleaks ## Run gitleaks for secret detection
169+
.bin/gitleaks detect --source . --verbose
130170

131171
.PHONY: sec-trivy
132-
sec-trivy: build ## Run trivy vulnerability scan on built binary
133-
@command -v trivy >/dev/null 2>&1 || { echo "trivy not found. Install: brew install trivy (macOS) or see https://aquasecurity.github.io/trivy/"; exit 1; }
134-
trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH .
172+
sec-trivy: .bin/trivy build ## Run trivy vulnerability scan on built binary
173+
.bin/trivy fs --scanners vuln,secret,misconfig --severity CRITICAL,HIGH .
135174

136175
# ==============================================================================
137176
# ENVIRONMENT HELPERS

0 commit comments

Comments
 (0)