|
| 1 | +# THIS CODE WAS AUTOGENERATED. DO NOT MODIFY THIS FILE DIRECTLY |
| 2 | +# THE SOURCE CODE LIVES IN A DIFFERENT REPOSITORY: |
| 3 | +# - centralized-templates |
| 4 | +# FILE STEWARD: @pleo-io/security |
| 5 | + |
| 6 | +name: CodeQL Analysis |
| 7 | + |
| 8 | +on: |
| 9 | + push: |
| 10 | + branches: |
| 11 | + - main |
| 12 | + - master |
| 13 | + - develop |
| 14 | + pull_request: |
| 15 | + branches: |
| 16 | + - main |
| 17 | + - master |
| 18 | + - develop |
| 19 | + |
| 20 | +env: |
| 21 | + language_Kotlin: "java" |
| 22 | + language_Java: "java" |
| 23 | + language_Go: "go" |
| 24 | + language_Python: "python" |
| 25 | + language_JavaScript: "javascript" |
| 26 | + language_TypeScript: "javascript" |
| 27 | + WORKING_LANGUAGE: "" |
| 28 | + CONFIG_FILE: "" |
| 29 | + RUN_ON_DEFAULT_BRANCH: true |
| 30 | + GRADLE_SCRIPT_PATH: ./gradlew |
| 31 | + setWizCliDepsScanPath: . |
| 32 | + setWizCliDepsPolicy: Pleo-Default-vulnerabilities-policy |
| 33 | + |
| 34 | +jobs: |
| 35 | + preflight: |
| 36 | + name: Determine if CodeQL should run |
| 37 | + runs-on: ubuntu-latest |
| 38 | + outputs: |
| 39 | + should_run_analyze: ${{ steps.maybe_skip_analyze.outputs.should_run_analyze }} |
| 40 | + working_language: ${{steps.working_language_step.outputs.WORKING_LANGUAGE}} |
| 41 | + steps: |
| 42 | + - uses: winterjung/split@a211a1c46e35fcdc4097d59dd6282d4a9859651b # v2 |
| 43 | + id: split |
| 44 | + with: |
| 45 | + msg: ${{ github.repository }} |
| 46 | + separator: "/" |
| 47 | + - id: get_default_branch |
| 48 | + name: Determine our default branch |
| 49 | + |
| 50 | + with: |
| 51 | + route: GET /repos/{owner}/{repo} |
| 52 | + owner: ${{ github.repository_owner }} |
| 53 | + repo: ${{ steps.split.outputs._1 }} |
| 54 | + env: |
| 55 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 56 | + - id: set_default_branch |
| 57 | + name: Set our default branch |
| 58 | + run: echo "DEFAULT_BRANCH=${{ fromJson(steps.get_default_branch.outputs.data).default_branch }}" >> "$GITHUB_ENV" |
| 59 | + - id: maybe_skip_analyze |
| 60 | + name: Check if analyze should run |
| 61 | + shell: bash |
| 62 | + run: | |
| 63 | + if [[ "${{ env.RUN_ON_DEFAULT_BRANCH }}" == "false" && "${{ github.ref }}" == "refs/heads/${{ env.DEFAULT_BRANCH }}" && "${{ github.event_name }}" == "push" ]]; then |
| 64 | + echo "Skipping CodeQL analysis on main branch due to configuration" |
| 65 | + echo "should_run_analyze=false" >> "$GITHUB_OUTPUT" |
| 66 | + else |
| 67 | + echo "Running CodeQL analysis" |
| 68 | + echo "should_run_analyze=true" >> "$GITHUB_OUTPUT" |
| 69 | + fi |
| 70 | + - id: working_language_step |
| 71 | + name: We check if the repository language is supported by CodeQL |
| 72 | + run: echo "WORKING_LANGUAGE=${{env[format('language_{0}', github.event.repository.language)]}}" >> "$GITHUB_OUTPUT" |
| 73 | + |
| 74 | + wiz-cli: |
| 75 | + name: Scan Dependencies with Wiz CLI |
| 76 | + runs-on: ubuntu-latest |
| 77 | + defaults: |
| 78 | + run: |
| 79 | + shell: bash |
| 80 | + steps: |
| 81 | + - name: Check out repository |
| 82 | + uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4 |
| 83 | + |
| 84 | + - name: Check latest version of Wiz CLI |
| 85 | + id: version_check |
| 86 | + run: | |
| 87 | + raw_output=$(curl -sL https://wizcli.app.wiz.io/latest/wizcli-version) |
| 88 | + LATEST_VERSION=$(echo "$raw_output" | grep -oP '"\K[^-]*' | head -1) |
| 89 | + COMPLETE_VERSION=$(echo "$raw_output" | grep -oP '(?<=").*?(?=")') |
| 90 | + echo "version=$LATEST_VERSION" >> "$GITHUB_OUTPUT" |
| 91 | + echo "complete_version=$COMPLETE_VERSION" >> "$GITHUB_OUTPUT" |
| 92 | +
|
| 93 | + - name: Cache Wiz CLI |
| 94 | + uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4 |
| 95 | + id: cache_wizcli |
| 96 | + with: |
| 97 | + path: wizcli-${{ steps.version_check.outputs.version }} |
| 98 | + key: wizcli-${{ steps.version_check.outputs.version }} |
| 99 | + |
| 100 | + - name: Download Wiz CLI |
| 101 | + if: steps.cache_wizcli.outputs.cache-hit != 'true' |
| 102 | + run: curl -o wizcli-${{ steps.version_check.outputs.version }} https://wizcli.app.wiz.io/${{ steps.version_check.outputs.complete_version }}/wizcli && chmod +x wizcli-${{ steps.version_check.outputs.version }} |
| 103 | + |
| 104 | + - name: Authenticate to Wiz |
| 105 | + env: |
| 106 | + WIZ_CLIENT_ID: ${{ secrets.WIZ_CLIENT_ID }} |
| 107 | + WIZ_CLIENT_SECRET: ${{ secrets.WIZ_CLIENT_SECRET }} |
| 108 | + run: ./wizcli-${{ steps.version_check.outputs.version }} auth --id "$WIZ_CLIENT_ID" --secret "$WIZ_CLIENT_SECRET" |
| 109 | + |
| 110 | + - name: Run wiz CLI Dependency Scan |
| 111 | + run: ./wizcli-${{ steps.version_check.outputs.version }} dir scan --path "${{ env.setWizCliDepsScanPath }}" --policy "${{ env.setWizCliDepsPolicy }}" |
| 112 | + |
| 113 | + analyze-code: |
| 114 | + name: Analyze code with CodeQL |
| 115 | + if: ${{ (needs.preflight.outputs.should_run_analyze == 'true') && (needs.preflight.outputs.working_language != '')}} |
| 116 | + needs: |
| 117 | + - preflight |
| 118 | + - wiz-cli |
| 119 | + runs-on: codeql-runner |
| 120 | + timeout-minutes: 30 |
| 121 | + permissions: |
| 122 | + actions: read |
| 123 | + contents: read |
| 124 | + security-events: write |
| 125 | + steps: |
| 126 | + - name: Checkout repository |
| 127 | + uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4 |
| 128 | + - name: Set Working Language |
| 129 | + run: echo "WORKING_LANGUAGE=${{needs.preflight.outputs.working_language}}" >> "$GITHUB_ENV" |
| 130 | + # Set up a JDK environment for building, testing and releasing. |
| 131 | + - name: Set up JDK 17 |
| 132 | + uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1 |
| 133 | + if: ${{ env.WORKING_LANGUAGE == 'java' }} |
| 134 | + with: |
| 135 | + java-version: 17 |
| 136 | + distribution: temurin |
| 137 | + |
| 138 | + # Allow caching Gradle executions to further speed up CI/CD steps invoking Gradle. |
| 139 | + - name: Setup Gradle |
| 140 | + uses: gradle/actions/setup-gradle@db19848a5fa7950289d3668fb053140cf3028d43 # v3.3.2 |
| 141 | + if: ${{ env.WORKING_LANGUAGE == 'java' }} |
| 142 | + with: |
| 143 | + gradle-version: wrapper |
| 144 | + cache-read-only: true |
| 145 | + |
| 146 | + # Set up a Node environment for JS/TS/Node client generation. |
| 147 | + - name: Set up Node 20 |
| 148 | + uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4 |
| 149 | + if: ${{ env.WORKING_LANGUAGE == 'javascript' }} |
| 150 | + with: |
| 151 | + node-version: 20 |
| 152 | + |
| 153 | + # Initializes the CodeQL tools for scanning. |
| 154 | + - name: Initialize CodeQL |
| 155 | + uses: github/codeql-action/init@d39d31e687223d841ef683f52467bd88e9b21c14 # v3 |
| 156 | + with: |
| 157 | + languages: ${{ github.event.repository.language }} |
| 158 | + ram: 4096 |
| 159 | + queries: security-and-quality |
| 160 | + tools: latest |
| 161 | + config-file: ${{ env.CONFIG_FILE }} |
| 162 | + |
| 163 | + - name: Gradle Build |
| 164 | + run: ${{ env.GRADLE_SCRIPT_PATH }} classes testClasses --stacktrace -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.parallel=true |
| 165 | + if: ${{ env.WORKING_LANGUAGE == 'java' }} |
| 166 | + env: |
| 167 | + GITHUB_TOKEN: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }} |
| 168 | + GRADLE_READ_KEY: ${{ secrets.GH_REGISTRY_GRADLE_TOKEN }} |
| 169 | + JOB_RUNR_REPO_PASSWORD: ${{ secrets.JOB_RUNR_REPO_PASSWORD }} |
| 170 | + |
| 171 | + - name: Perform CodeQL Analysis |
| 172 | + uses: github/codeql-action/analyze@d39d31e687223d841ef683f52467bd88e9b21c14 # v3 |
| 173 | + with: |
| 174 | + ram: 4096 |
0 commit comments