Skip to content

Commit 7ecd986

Browse files
Ilan-kumaranIlan-kumaran
authored
Merge pull request #8 from contentstack/feature/OAA-2926
feat: adding tls capability on epicurous
2 parents 4bfcedf + dfdb0a4 commit 7ecd986

13 files changed

Lines changed: 254 additions & 6 deletions

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
pull_request:
16+
# The branches below must be a subset of the branches above
17+
branches: '*'
18+
19+
jobs:
20+
analyze:
21+
name: Analyze
22+
runs-on: ubuntu-latest
23+
permissions:
24+
actions: read
25+
contents: read
26+
security-events: write
27+
28+
strategy:
29+
fail-fast: false
30+
matrix:
31+
language: [ 'javascript' ]
32+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
33+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
34+
35+
steps:
36+
- name: Checkout repository
37+
uses: actions/checkout@v3
38+
39+
# Initializes the CodeQL tools for scanning.
40+
- name: Initialize CodeQL
41+
uses: github/codeql-action/init@v2
42+
with:
43+
languages: ${{ matrix.language }}
44+
# If you wish to specify custom queries, you can do so here or in a config file.
45+
# By default, queries listed here will override any specified in a config file.
46+
# Prefix the list here with "+" to use these queries and those in the config file.
47+
48+
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
49+
# queries: security-extended,security-and-quality
50+
51+
52+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
53+
# If this step fails, then you should remove it and run the build manually (see below)
54+
- name: Autobuild
55+
uses: github/codeql-action/autobuild@v2
56+
57+
# ℹ️ Command-line programs to run using the OS shell.
58+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
59+
60+
# If the Autobuild fails above, remove it and uncomment the following three lines.
61+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
62+
63+
# - run: |
64+
# echo "Run, Build Application using script"
65+
# ./location_of_script_within_repo/buildscript.sh
66+
67+
- name: Perform CodeQL Analysis
68+
uses: github/codeql-action/analyze@v2

‎.github/workflows/issues-jira.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Create Jira Ticket for Github Issue
2+
3+
on:
4+
issues:
5+
types: [opened]
6+
7+
jobs:
8+
issue-jira:
9+
runs-on: ubuntu-latest
10+
steps:
11+
12+
- name: Login to Jira
13+
uses: atlassian/gajira-login@master
14+
env:
15+
JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
16+
JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
17+
JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
18+
19+
- name: Create Jira Issue
20+
id: create_jira
21+
uses: atlassian/gajira-create@master
22+
with:
23+
project: ${{ secrets.JIRA_PROJECT }}
24+
issuetype: ${{ secrets.JIRA_ISSUE_TYPE }}
25+
summary: Github | Issue | ${{ github.event.repository.name }} | ${{ github.event.issue.title }}
26+
description: |
27+
*GitHub Issue:* ${{ github.event.issue.html_url }}
28+
29+
*Description:*
30+
${{ github.event.issue.body }}
31+
fields: "${{ secrets.ISSUES_JIRA_FIELDS }}"

‎.github/workflows/policy-scan.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Checks the security policy and configurations
2+
on:
3+
pull_request:
4+
types: [opened, synchronize, reopened]
5+
jobs:
6+
security-policy:
7+
if: github.event.repository.visibility == 'public'
8+
runs-on: ubuntu-latest
9+
defaults:
10+
run:
11+
shell: bash
12+
steps:
13+
- uses: actions/checkout@master
14+
- name: Checks for SECURITY.md policy file
15+
run: |
16+
if ! [[ -f "SECURITY.md" || -f ".github/SECURITY.md" ]]; then exit 1; fi
17+
security-license:
18+
if: github.event.repository.visibility == 'public'
19+
runs-on: ubuntu-latest
20+
defaults:
21+
run:
22+
shell: bash
23+
steps:
24+
- uses: actions/checkout@master
25+
- name: Checks for License file
26+
run: |
27+
expected_license_files=("LICENSE" "LICENSE.txt" "LICENSE.md" "License.txt")
28+
license_file_found=false
29+
current_year=$(date +"%Y")
30+
31+
for license_file in "${expected_license_files[@]}"; do
32+
if [ -f "$license_file" ]; then
33+
license_file_found=true
34+
# check the license file for the current year, if not exists, exit with error
35+
if ! grep -q "$current_year" "$license_file"; then
36+
echo "License file $license_file does not contain the current year."
37+
exit 2
38+
fi
39+
break
40+
fi
41+
done
42+
43+
if [ "$license_file_found" = false ]; then
44+
echo "No license file found. Please add a license file to the repository."
45+
exit 1
46+
fi

‎.github/workflows/sca-scan.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: Source Composition Analysis Scan
2+
on:
3+
pull_request:
4+
types: [opened, synchronize, reopened]
5+
jobs:
6+
security-sca:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@master
10+
- name: Run Snyk to check for vulnerabilities
11+
uses: snyk/actions/node@master
12+
env:
13+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
14+
with:
15+
args: --all-projects --fail-on=all

‎.github/workflows/secrets-scan.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Secrets Scan
2+
on:
3+
pull_request:
4+
types: [opened, synchronize, reopened]
5+
jobs:
6+
security-secrets:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v4
10+
with:
11+
fetch-depth: '2'
12+
ref: '${{ github.event.pull_request.head.ref }}'
13+
- run: |
14+
git reset --soft HEAD~1
15+
- name: Install Talisman
16+
run: |
17+
# Download Talisman
18+
wget https://github.com/thoughtworks/talisman/releases/download/v1.37.0/talisman_linux_amd64 -O talisman
19+
20+
# Checksum verification
21+
checksum=$(sha256sum ./talisman | awk '{print $1}')
22+
if [ "$checksum" != "8e0ae8bb7b160bf10c4fa1448beb04a32a35e63505b3dddff74a092bccaaa7e4" ]; then exit 1; fi
23+
24+
# Make it executable
25+
chmod +x talisman
26+
- name: Run talisman
27+
run: |
28+
# Run Talisman with the pre-commit hook
29+
./talisman --githook pre-commit

‎.snyk‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
2+
version: v1.25.0
3+
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
4+
ignore:
5+
SNYK-JS-REDIS-1255645:
6+
- '*':
7+
reason: 'High Severity - https://contentstack.atlassian.net/browse/IS-1224'
8+
expires: 2025-06-15T05:52:48.301Z
9+
created: 2025-05-15T05:52:48.306Z
10+
patch: {}

‎.talismanrc‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
fileignoreconfig:
2+
- filename: .github/workflows/secrets-scan.yml
3+
ignore_detectors:
4+
- filecontent
5+
- filename: package-lock.json
6+
checksum: 8dae940d01a846b804a410f9c59b8b173866342950ec0e75026640326bdb8b8c
7+
version: "1.0"

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @contentstack/security-admin

‎LICENSE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
MIT License
22

3-
Copyright (c) 2018 ABX
3+
Copyright (c) 2018-2025 ABX
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

‎SECURITY.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
Security
3+
Contentstack takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations.
4+
5+
If you believe you have found a security vulnerability in any Contentstack-owned repository, please report it to us as described below.
6+
7+
Reporting Security Issues
8+
Please do not report security vulnerabilities through public GitHub issues.
9+
10+
Send email to security@contentstack.com.
11+
12+
You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
13+
14+
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
15+
16+
Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
17+
Full paths of source file(s) related to the manifestation of the issue
18+
The location of the affected source code (tag/branch/commit or direct URL)
19+
Any special configuration required to reproduce the issue
20+
Step-by-step instructions to reproduce the issue
21+
Proof-of-concept or exploit code (if possible)
22+
Impact of the issue, including how an attacker might exploit the issue
23+
This information will help us triage your report more quickly.
24+
25+
https://www.contentstack.com/trust/

0 commit comments

Comments
 (0)