Skip to content

Commit 2a65738

Browse files
CalinLCalinL
authored
Merge pull request #18 from githubabcs-devops/feature/devopsshield-devsecops-automation-202501090432
🚀 DevOps Shield - DevSecOps Automation - Apply AppSec Configurations
2 parents 130dd20 + ab39b4b commit 2a65738

5 files changed

Lines changed: 321 additions & 0 deletions

‎.github/workflows/devopsshield-cis-trivy.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
2+
# https://devopsshield.com
3+
##############################################################
4+
# This is a DevOps Shield - Application Security - Code Security Template.
5+
6+
# This workflow template uses actions that are not certified by DevOps Shield.
7+
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
8+
9+
# Use this workflow template for integrating code security into your pipelines and workflows.
10+
11+
# DevOps Shield Workflow Template Details:
12+
# ------------------------------------------------------------
13+
# Code: GH_CIS_TRIVY
14+
# Name: Trivy Container Image Scanning
15+
# DevSecOpsControls: CIS
16+
# Provider: Aqua Security
17+
# Categories: Code Scanning, Dockerfile
18+
# Description:
19+
# Scan Docker container images for vulnerabilities in OS packages and language dependencies with Trivy from Aqua Security.
20+
# Trivy is a comprehensive and versatile security scanner.
21+
# Trivy has scanners that look for security issues, and targets where it can find those issues.
22+
# Read the official documentation to find out more.
23+
# For more information:
24+
# https://trivy.dev/latest/
25+
# https://github.com/aquasecurity/trivy
26+
# ------------------------------------------------------------
27+
# Source repository: https://github.com/aquasecurity/trivy-action
28+
##############################################################
29+
30+
name: Trivy Container Image Scanning
31+
32+
on:
33+
push:
34+
branches: [ main ]
35+
pull_request:
36+
branches: [ main ]
37+
schedule:
38+
- cron: 0 0 * * 0
39+
40+
jobs:
41+
trivy:
42+
name: Trivy vulnerability scanner
43+
44+
runs-on: ubuntu-latest
45+
46+
permissions:
47+
contents: read # for actions/checkout to fetch code
48+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
49+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
50+
51+
steps:
52+
- name: Checkout code
53+
uses: actions/checkout@v4
54+
55+
- name: Build an image from Dockerfile
56+
run: |
57+
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
58+
59+
- name: Run Trivy vulnerability scanner
60+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
61+
with:
62+
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
63+
format: 'sarif'
64+
output: 'trivy-results.sarif'
65+
66+
- name: Upload Trivy scan results to GitHub Security tab
67+
uses: github/codeql-action/upload-sarif@v3
68+
with:
69+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/devopsshield-dast-zed-attack-proxy-zap.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
2+
# https://devopsshield.com
3+
##############################################################
4+
# This is a DevOps Shield - Application Security - Code Security Template.
5+
6+
# This workflow template uses actions that are not certified by DevOps Shield.
7+
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
8+
9+
# Use this workflow template for integrating code security into your pipelines and workflows.
10+
11+
# DevOps Shield Workflow Template Details:
12+
# ------------------------------------------------------------
13+
# Code: GH_DAST_Zed_Attack_Proxy_ZAP
14+
# Name: Zed Attack Proxy (ZAP) Penetration Testing
15+
# DevSecOpsControls: DAST
16+
# Provider: Checkmarx
17+
# Categories: Code Scanning, Penetration Testing
18+
# Description:
19+
# Zed Attack Proxy (ZAP) by Checkmarx is a free, open-source penetration testing tool.
20+
# ZAP is designed specifically for testing web applications and is both flexible and extensible.
21+
# Automate with ZAP. ZAP provides range of options for security automation.
22+
# The world�s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to.
23+
# A GitHub Action for running the ZAP Full Scan to perform Dynamic Application Security Testing (DAST).
24+
# The ZAP full scan action runs the ZAP spider against the specified target (by default with no time limit) followed by an optional ajax spider scan and then a full active scan before reporting the results.
25+
# WARNING this action will perform attacks on the target website. You should only scan targets that you have permission to test.
26+
# Read the official documentation to find out more.
27+
# For more information:
28+
# https://www.zaproxy.org/
29+
# https://www.zaproxy.org/docs/
30+
# https://github.com/zaproxy/
31+
# https://www.zaproxy.org/docs/automate/
32+
# https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/
33+
# ------------------------------------------------------------
34+
# Source repository: https://github.com/zaproxy/action-full-scan
35+
##############################################################
36+
37+
name: Zed Attack Proxy (ZAP) Full Scan
38+
39+
on:
40+
push:
41+
branches: [ main ]
42+
schedule:
43+
- cron: 0 0 * * 0
44+
45+
jobs:
46+
zap_scan:
47+
name: ZAP Full Scan
48+
runs-on: ubuntu-latest
49+
50+
permissions:
51+
contents: read
52+
53+
steps:
54+
- uses: actions/checkout@v4
55+
56+
- name: Run ZAP Scan
57+
uses: zaproxy/action-full-scan@v0.12.0
58+
id: zap
59+
with:
60+
target: 'https://www.zaproxy.org/'

‎.github/workflows/devopsshield-msdo-microsoft-security-devops.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
2+
# https://devopsshield.com
3+
##############################################################
4+
# This is a DevOps Shield - Application Security - Code Security Template.
5+
6+
# This workflow template uses actions that are not certified by DevOps Shield.
7+
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
8+
9+
# Use this workflow template for integrating code security into your pipelines and workflows.
10+
11+
# DevOps Shield Workflow Template Details:
12+
# ------------------------------------------------------------
13+
# Code: GH_MSDO_Microsoft_Security_DevOps
14+
# Name: Microsoft Security DevOps (MSDO) - Defender for DevOps
15+
# DevSecOpsControls: SAST, CIS, IACS
16+
# Provider: Microsoft
17+
# Categories: Code Scanning, Dockerfile, Python, JavaScript, EcmaScript, TypeScript, C#, .NET, ARM Template, Bicep, Kubernetes, JSON, YAML, CloudFormation, HCL, Terraform
18+
# Description:
19+
# Microsoft Security DevOps (MSDO) is a command line application which integrates static analysis tools into the development cycle.
20+
# MSDO installs, configures and runs the latest versions of static analysis tools (including, but not limited to, SDL/security and compliance tools).
21+
# Defender for DevOps helps integrate multiple tools with Advanced Security and sends the results to Defender for Cloud dashboard.
22+
# Please note this workflow do not integrate with Microsoft Defender For DevOps.
23+
# You have to create an integration and provide permission before this can report data back to Azure.
24+
# Read the official documentation to find out more.
25+
# For more information:
26+
# https://github.com/microsoft/security-devops-action
27+
# https://learn.microsoft.com/en-us/azure/defender-for-cloud/github-action
28+
# https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github
29+
# ------------------------------------------------------------
30+
# Source repository: https://github.com/microsoft/security-devops-action
31+
##############################################################
32+
33+
name: Microsoft Security DevOps (MSDO) - Defender for DevOps
34+
35+
on:
36+
push:
37+
branches: [ main ]
38+
pull_request:
39+
branches: [ main ]
40+
schedule:
41+
- cron: 0 0 * * 0
42+
43+
jobs:
44+
MSDO:
45+
name: Microsoft Security DevOps (MSDO)
46+
47+
# Windows and Linux agents are supported
48+
runs-on: windows-latest
49+
50+
permissions:
51+
contents: read
52+
# Write access for security-events is only required for customers looking for MSDO results to appear in the codeQL security alerts tab on GitHub (Requires GHAS)
53+
security-events: write
54+
55+
steps:
56+
# Checkout your code repository to scan
57+
- uses: actions/checkout@v4
58+
59+
# Run analyzers
60+
- name: Run Microsoft Security DevOps
61+
uses: microsoft/security-devops-action@v1.6.0
62+
id: msdo
63+
# with:
64+
# config: string. Optional. A file path to an MSDO configuration file ('*.gdnconfig').
65+
# policy: 'GitHub' | 'microsoft' | 'none'. Optional. The name of a well-known Microsoft policy. If no configuration file or list of tools is provided, the policy may instruct MSDO which tools to run. Default: GitHub.
66+
# categories: string. Optional. A comma-separated list of analyzer categories to run. Values: 'code', 'artifacts', 'IaC', 'containers'. Example: 'IaC, containers'. Defaults to all.
67+
# languages: string. Optional. A comma-separated list of languages to analyze. Example: 'javascript,typescript'. Defaults to all.
68+
# tools: string. Optional. A comma-separated list of analyzer tools to run. Values: 'bandit', 'binskim', 'checkov', 'eslint', 'templateanalyzer', 'terrascan', 'trivy'.
69+
70+
# Upload alerts to the Security tab - required for MSDO results to appear in the codeQL security alerts tab on GitHub (Requires GHAS)
71+
- name: Upload results to Security tab
72+
uses: github/codeql-action/upload-sarif@v3
73+
with:
74+
sarif_file: ${{ steps.msdo.outputs.sarifFile }}

‎.github/workflows/devopsshield-ss-gitleaks.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
2+
# https://devopsshield.com
3+
##############################################################
4+
# This is a DevOps Shield - Application Security - Code Security Template.
5+
6+
# This workflow template uses actions that are not certified by DevOps Shield.
7+
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
8+
9+
# Use this workflow template for integrating code security into your pipelines and workflows.
10+
11+
# DevOps Shield Workflow Template Details:
12+
# ------------------------------------------------------------
13+
# Code: GH_SS_GITLEAKS
14+
# Name: Gitleaks Secret Scanning
15+
# DevSecOpsControls: SS
16+
# Provider: Gitleaks
17+
# Categories: Code Scanning, Secrets
18+
# Description:
19+
# Gitleaks is a tool for detecting and preventing hardcoded secrets like passwords, API keys, and tokens in git repos.
20+
# Gitleaks is an easy-to-use, all-in-one solution for detecting secrets, past or present, in your code.
21+
# Enable Gitleaks-Action in your GitHub workflows to be alerted when secrets are leaked as soon as they happen.
22+
# A gitleaks-action license can be obtained at gitleaks.io.
23+
# Read the official documentation to find out more.
24+
# For more information:
25+
# https://gitleaks.io/
26+
# https://github.com/gitleaks
27+
# https://blog.gitleaks.io/
28+
# ------------------------------------------------------------
29+
# Source repository: https://github.com/gitleaks/gitleaks-action
30+
##############################################################
31+
32+
name: Gitleaks Secret Scanning
33+
34+
on:
35+
push:
36+
pull_request:
37+
workflow_dispatch:
38+
schedule:
39+
- cron: 0 0 * * *
40+
41+
jobs:
42+
gitleaks:
43+
name: Gitleaks Secret Scanning
44+
45+
runs-on: ubuntu-latest
46+
47+
permissions:
48+
contents: read
49+
50+
steps:
51+
- uses: actions/checkout@v4
52+
with:
53+
fetch-depth: 0
54+
55+
- name: Run Gitleaks
56+
uses: gitleaks/gitleaks-action@v2
57+
id: gitleaks
58+
env:
59+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
60+
GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} # Only required for Organizations, not personal accounts.

‎.github/workflows/devopsshield-ss-trufflehog.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
2+
# https://devopsshield.com
3+
##############################################################
4+
# This is a DevOps Shield - Application Security - Code Security Template.
5+
6+
# This workflow template uses actions that are not certified by DevOps Shield.
7+
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
8+
9+
# Use this workflow template for integrating code security into your pipelines and workflows.
10+
11+
# DevOps Shield Workflow Template Details:
12+
# ------------------------------------------------------------
13+
# Code: GH_SS_TRUFFLEHOG
14+
# Name: TruffleHog Secret Scanning
15+
# DevSecOpsControls: SS
16+
# Provider: Truffle Security Co.
17+
# Categories: Code Scanning, Secrets
18+
# Description:
19+
# TruffleHog is the most powerful secrets Discovery, Classification, Validation, and Analysis tool.
20+
# In this context secret refers to a credential a machine uses to authenticate itself to another machine.
21+
# This includes API keys, database passwords, private encryption keys, and more.
22+
# Find, verify, and analyze leaked credentials.
23+
# Read the official documentation to find out more.
24+
# For more information:
25+
# https://trufflesecurity.com/
26+
# https://github.com/trufflesecurity/trufflehog
27+
# ------------------------------------------------------------
28+
# Source repository: https://github.com/trufflesecurity/trufflehog?tab=readme-ov-file#octocat-trufflehog-github-action
29+
##############################################################
30+
31+
name: TruffleHog Secret Scanning
32+
33+
on:
34+
push:
35+
pull_request:
36+
workflow_dispatch:
37+
schedule:
38+
- cron: 0 0 * * *
39+
40+
jobs:
41+
gitleaks:
42+
name: TruffleHog Secret Scanning
43+
44+
runs-on: ubuntu-latest
45+
46+
permissions:
47+
contents: read
48+
49+
steps:
50+
- uses: actions/checkout@v4
51+
with:
52+
fetch-depth: 0
53+
54+
- name: Run TruffleHog
55+
uses: trufflesecurity/trufflehog@v3
56+
id: trufflehog
57+
with:
58+
extra_args: --results=verified,unknown

0 commit comments

Comments
 (0)