Skip to content

Commit 569a40a

Browse files
damienjburksdamienjburks
authored
Merge pull request #4 from thogue12/testing
edit
2 parents 03d76b4 + 99c5fdc commit 569a40a

8 files changed

Lines changed: 109 additions & 183 deletions

File tree

‎.github/.DS_Store‎

0 Bytes
Binary file not shown.

‎.github/workflows/build-image.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,5 @@ jobs:
1515

1616
- name: Build Docker Image
1717
run: |
18-
docker build -t awesome-fastapi:${{ github.sha }} .
18+
docker build -t awesome-fastapi:${{ github.sha }} .
19+

‎.github/workflows/lint-format.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,8 @@ jobs:
2020

2121
- name: Install dependencies
2222
run: |
23+
pip install -r requirements.txt
2324
python -m pip install --upgrade pip
24-
pip install pylint
25-
pip install pylint black
2625
2726
- name: Run pylint
2827
run: pylint .

‎.github/workflows/main.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
name: Main Workflow
22
on:
33
push:
4-
branches:
5-
- main
4+
5+
workflow_dispatch:
66

77
permissions:
88
contents: read
99
security-events: write
1010
actions: read
11+
id-token: write
12+
packages: write
1113

1214

1315
jobs:
@@ -20,4 +22,8 @@ jobs:
2022

2123
unit-sec-scan:
2224
uses: ./.github/workflows/unit-sec-test.yml
23-
needs: lint-format
25+
needs: lint-format
26+
27+
push-docker-image:
28+
uses: ./.github/workflows/push-docker-image.yml
29+
needs: unit-sec-scan

‎.github/workflows/pr.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: PR Workflow
22
on:
3-
pull_request_target:
3+
pull_request:
44
types:
55
- opened
66
- edited

‎.github/workflows/push-docker-image.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Push Docker Image
2+
3+
4+
on:
5+
workflow_call:
6+
7+
env:
8+
# Use docker.io for Docker Hub if empty
9+
REGISTRY: ghcr.io
10+
IMAGE_NAME: 'awesome-fastapi'
11+
12+
13+
jobs:
14+
Push_Image:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v4
19+
20+
# Set up Docker Buildx
21+
- name: Set up Docker Buildx
22+
id: buildx
23+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
24+
25+
# Extract metadata (tags, labels) for Docker
26+
- name: Extract metadata for Docker
27+
id: meta
28+
uses: docker/metadata-action@v3
29+
with:
30+
images: ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
31+
32+
# Login against a Docker registry
33+
- name: Log into registry ${{ env.REGISTRY }}
34+
if: github.event_name != 'pull_request'
35+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
42+
# Build and tag Docker Image
43+
- name: Build Docker Image
44+
run: |
45+
docker build -t ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
46+
47+
- name: Tag Docker Image
48+
run: |
49+
docker tag ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
50+
docker tag ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }} ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:testing
51+
52+
53+
# Push the Docker image to the registry
54+
- name: Push Docker Image to GHCR
55+
run: |
56+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
57+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:latest
58+
docker push ghcr.io/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:testing

‎.github/workflows/unit-sec-test.yml‎

Lines changed: 38 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -13,42 +13,12 @@ jobs:
1313
uses: actions/checkout@v4
1414

1515
- name: Install dependencies
16-
run: pip install -r requirements.txt
17-
16+
run: |
17+
pip install -r requirements.txt
18+
1819
- name: Run tests
1920
run: pytest tests/
20-
21-
22-
# Run snyk code scanning for vulnerabilities
23-
snyk_scan:
24-
permissions:
25-
contents: read
26-
security-events: write
27-
actions: read
28-
runs-on: ubuntu-latest
29-
steps:
30-
- uses: actions/checkout@v4
31-
- name: Set up Python
32-
uses: actions/setup-python@v4
33-
with:
34-
python-version: "3.12.5"
35-
3621

37-
- name: Install dependencies
38-
run: pip install -r requirements.txt
39-
40-
- name: Install Snyk CLI
41-
uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
42-
43-
env:
44-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
45-
- name: Snyk Code test
46-
run: snyk code test --sarif > snyk-cide.sarif
47-
48-
- name: Snyk Test Dependencies
49-
run: snyk test
50-
51-
5222
# Scan the contianer and lists all security vulnerabilities
5323
trivy_scans:
5424
name: Run Trivy security scanner against the image
@@ -57,13 +27,16 @@ jobs:
5727
- name: Checkout code
5828
uses: actions/checkout@v4
5929

60-
- name: Run Trivy vulnerability scanner
61-
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
30+
- name: Build Docker Image
31+
run: |
32+
docker build -t awesome-fastapi:${{ github.sha }} . ###- This section needed to be added becasue the image was not persisting between jobs--##
33+
34+
- name: Run Trivy Vulnerability Scanner
35+
uses: aquasecurity/trivy-action@0.28.0
6236
with:
6337
image-ref: 'awesome-fastapi:${{ github.sha }}'
64-
format: 'template'
65-
template: '@/contrib/sarif.tpl'
66-
output: 'GitHub Actions/Trivy Automation'
38+
format: 'sarif'
39+
output: 'trivy-results.sarif'
6740
severity: 'CRITICAL,HIGH'
6841

6942
- name: Upload Trivy scan results to GitHub Security tab
@@ -75,17 +48,30 @@ jobs:
7548
runs-on: ubuntu-latest
7649
name: app scan
7750
steps:
78-
- name: Checkout
79-
uses: actions/checkout@v4
80-
with:
81-
ref: master
82-
83-
- name: zap scan
84-
uses: zaproxy/action-api-scan@v0.9.0
85-
with:
86-
token: ${{ secrets.GITHUB_TOKEN}}
87-
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
88-
format: openapi
89-
target: '<fast-api-url>'
90-
rules_file_name: '.zap/rules.tsv'
91-
cmd_options: '-a'
51+
- name: Checkout
52+
uses: actions/checkout@v4
53+
54+
# Build and Tag Image
55+
# Run Docker Image in detached mode
56+
- name: Build Docker Image
57+
run: |
58+
docker build -t awesome-fastapi:${{ github.sha }} .
59+
docker run -d -p 8080:8080 awesome-fastapi:${{ github.sha }}
60+
61+
- name: Wait for Docker container to be ready
62+
run: sleep 30
63+
64+
- name: Confirm Docker container is running
65+
run: docker ps
66+
67+
# Run OWASP ZAP scan
68+
- name: zap scan
69+
uses: zaproxy/action-api-scan@v0.9.0
70+
with:
71+
token: ${{ secrets.GITHUB_TOKEN }}
72+
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
73+
format: openapi
74+
target: 'http://0.0.0.0:8080'
75+
rules_file_name: '.zap/rules.tsv'
76+
cmd_options: '-a'
77+
allow_issue_writing: false

‎DevSecOps-Pipeline.yml‎

Lines changed: 0 additions & 124 deletions
This file was deleted.

0 commit comments

Comments
 (0)