Skip to content

Commit ca0c31e

Browse files
vadim-unitvadim-unit
committed
feat: adding github actions
1 parent 07142c2 commit ca0c31e

File tree

4 files changed

+189
-0
lines changed

4 files changed

+189
-0
lines changed

‎.github/workflows/CI-appsec-blackduck-master.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: CI-AppSec [Master]
2+
on:
3+
schedule:
4+
#At 13:00 on every day-of-week from Sunday through Thursday.
5+
- cron: '0 13 * * SUN-THU'
6+
workflow_dispatch:
7+
#The workflow will only run when a push that includes a change to the package.json file is made in the main branch.
8+
push:
9+
branches:
10+
- main
11+
paths:
12+
- 'package.json'
13+
14+
jobs:
15+
blackduck-scan:
16+
runs-on: [ ubuntu-latest ]
17+
steps:
18+
- name: Checkout Source
19+
uses: actions/checkout@v3
20+
21+
22+
- name: Black Duck Full Scan
23+
uses: synopsys-sig/[email protected]
24+
25+
### Use below configuration to set specific detect environment variables
26+
env:
27+
DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
28+
DETECT_PROJECT_VERSION_NAME: main
29+
with:
30+
blackduck_url: ${{ secrets.BLACKDUCK_URL }}
31+
blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
32+
blackduck_scan_full: true
33+
34+
### Accepts Multiple Values
35+
blackduck_scan_failure_severities: 'BLOCKER,CRITICAL'
36+
37+
### Uncomment below configuration to enable automatic fix pull request creation if vulnerabilities are reported
38+
blackduck_fixpr_enabled: true
39+
blackduck_fixpr_maxCount: 5
40+
blackduck_fixpr_filter_severities: 'CRITICAL,HIGH'
41+
blackduck_fixpr_useUpgradeGuidance: 'SHORT_TERM,LONG_TERM'
42+
github_token: ${{ secrets.GITHUB_TOKEN }} # Mandatory when blackduck_fixpr_enabled is set to 'true'
43+
44+
### Uncomment below configuration if Synopsys Bridge diagnostic files needs to be uploaded
45+
# include_diagnostics: true
46+
47+
- name: If failed - Configure 1Password Service Account For Slack Webhook URL Secret
48+
uses: 1password/load-secrets-action/configure@v1
49+
if: ${{ failure() }}
50+
with:
51+
service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
52+
- name: If failed - Load Slack Webhook URL Secret
53+
uses: 1password/load-secrets-action@v1
54+
if: ${{ failure() }}
55+
with:
56+
export-env: true
57+
env:
58+
SLACK_WEBHOOK_URL: op://Security/slack-appsec-blackduck-alerts/webhook-url
59+
- name: If failed - Report failure to Slack
60+
#Slack channel: appsec-blackduck-alerts
61+
uses: ravsamhq/notify-slack-action@v2
62+
if: ${{ failure() }}
63+
with:
64+
status: ${{ job.status }}
65+
token: ${{ secrets.GITHUB_TOKEN }}
66+
notification_title: "{workflow} has {status_message}"
67+
message_format: "{emoji} *{workflow}* {status_message} in <{run_url}|{repo}>"
68+
footer: "Linked Run <{run_url}|{repo}>"
69+
notify_when: "failure"
70+
mention_users: "U040AD4BT42"
71+
mention_users_when: "failure,warnings"
72+
mention_groups: "!channel"
73+
env:
74+
SLACK_WEBHOOK_URL: ${{ env.SLACK_WEBHOOK_URL }}
75+

‎.github/workflows/CI-appsec-blackduck-pr.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: CI-AppSec [PR]
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
7+
jobs:
8+
blackduck-scan:
9+
runs-on: [ ubuntu-latest ]
10+
steps:
11+
- name: Checkout Source
12+
uses: actions/checkout@v3
13+
14+
- name: Black Duck PR Scan
15+
uses: synopsys-sig/[email protected]
16+
17+
### Use below configuration to set specific detect environment variables
18+
env:
19+
DETECT_PROJECT_NAME: ${{ github.event.repository.name }}
20+
DETECT_PROJECT_VERSION_NAME: main
21+
with:
22+
blackduck_url: ${{ secrets.BLACKDUCK_URL }}
23+
blackduck_token: ${{ secrets.BLACKDUCK_API_TOKEN }}
24+
blackduck_scan_full: false
25+
26+
### Below configuration is used to enable automatic pull request comment based on Black Duck scan result
27+
blackduck_prComment_enabled: true
28+
github_token: ${{ secrets.GITHUB_TOKEN }}
29+
# Mandatory when blackduck_automation_prcomment is set to 'true'
30+
31+
### Uncomment below configuration if Synopsys Bridge diagnostic files needs to be uploaded
32+
# include_diagnostics: true
33+
34+
- name: If failed - Configure 1Password Service Account For Slack Webhook URL Secret
35+
uses: 1password/load-secrets-action/configure@v1
36+
if: ${{ failure() }}
37+
with:
38+
service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
39+
- name: If failed - Load Slack Webhook URL Secret
40+
uses: 1password/load-secrets-action@v1
41+
if: ${{ failure() }}
42+
with:
43+
export-env: true
44+
env:
45+
SLACK_WEBHOOK_URL: op://Security/slack-appsec-blackduck-alerts/webhook-url
46+
- name: If failed - Report failure to Slack
47+
#Slack channel: appsec-blackduck-alerts
48+
uses: ravsamhq/notify-slack-action@v2
49+
if: ${{ failure() }}
50+
with:
51+
status: ${{ job.status }}
52+
token: ${{ secrets.GITHUB_TOKEN }}
53+
notification_title: "{workflow} has {status_message}"
54+
message_format: "{emoji} *{workflow}* {status_message} in <{run_url}|{repo}>"
55+
footer: "Linked Run <{run_url}|{repo}>"
56+
notify_when: "failure"
57+
mention_users: "U040AD4BT42"
58+
mention_users_when: "failure,warnings"
59+
mention_groups: "!channel"
60+
env:
61+
SLACK_WEBHOOK_URL: ${{ env.SLACK_WEBHOOK_URL }}
62+

‎.github/workflows/CI.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: CI
2+
on:
3+
pull_request:
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v2
10+
- uses: actions/setup-node@v1
11+
with:
12+
node-version: 16.x
13+
- run: npm ci
14+
- run: npm run build
15+
- run: |
16+
touch .env
17+
echo UNIT_TOKEN=${{ secrets.UNIT_TOKEN }} >> .env
18+
echo UNIT_API_URL=${{ secrets.UNIT_API_URL }} >> .env
19+
echo TEST_COUNTERPARTY_PLAID_TOKEN=${{ secrets.TEST_COUNTERPARTY_PLAID_TOKEN }} >> .env

‎.github/workflows/npm-publish.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
on:
2+
push:
3+
branches:
4+
- main
5+
6+
jobs:
7+
publish:
8+
if: github.repository_owner == 'unit-finance'
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v1
12+
- uses: actions/setup-node@v1
13+
with:
14+
node-version: 16
15+
- run: npm install
16+
- run: npm run build
17+
- name: Publish to NPM
18+
id: publish
19+
uses: JS-DevTools/npm-publish@v1
20+
with:
21+
token: ${{ secrets.NPM_TOKEN }}
22+
- name: Create Tag & Release
23+
if: steps.publish.outputs.type != 'none'
24+
id: create_release
25+
uses: actions/create-release@v1
26+
env:
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
with:
29+
tag_name: ${{ steps.publish.outputs.version }}
30+
release_name: Release ${{ steps.publish.outputs.version }}
31+
body: ${{ steps.publish.outputs.version }}
32+
draft: false
33+
prerelease: false

0 commit comments

Comments
 (0)