From 813d78167dc0d56646461740060a67acc20135bc Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 14:04:41 -0500 Subject: [PATCH 1/8] add flow --- .../workflow/frogbot-scan-pull-request.yml | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 .github/workflow/frogbot-scan-pull-request.yml diff --git a/.github/workflow/frogbot-scan-pull-request.yml b/.github/workflow/frogbot-scan-pull-request.yml new file mode 100644 index 00000000..0a28f13e --- /dev/null +++ b/.github/workflow/frogbot-scan-pull-request.yml @@ -0,0 +1,73 @@ +name: "Frogbot Scan Pull Request" +on: + pull_request_target: + types: [opened, synchronize] +permissions: + pull-requests: write + contents: read +jobs: + scan-pull-request: + runs-on: ubuntu-latest + # A pull request needs to be approved, before Frogbot scans it. Any GitHub user who is associated with the + # "frogbot" GitHub environment can approve the pull request to be scanned. + environment: artificatory + steps: + - uses: actions/checkout@v2 + with: + ref: ${{ github.event.pull_request.head.sha }} + + # Install prerequisites + - name: Setup Go + uses: actions/setup-go@v2 + with: + go-version: 1.18.x + + - uses: jfrog/frogbot@v2 + env: + # [Mandatory] + # JFrog platform URL (This functionality requires version 3.29.0 or above of Xray) + JF_URL: ${{ secrets.JF_URL }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD + JF_USER: ${{ secrets.JF_USER }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog password. Must be provided with JF_USER + JF_PASSWORD: ${{ secrets.JF_PASSWORD }} + + # [Mandatory] + # The GitHub token automatically generated for the job + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # Uncomment the below options if you'd like to use them. + + # [Optional, default: https://api.github.com] + # API endpoint to GitHub + # JF_GIT_API_ENDPOINT: https://github.example.com + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions on Xray service + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + # [Optional, default: "."] + # Relative path to the project in the git repository + # JF_WORKING_DIR: path/to/go.mod/dir + + # [Optional] + # Xray Watches. Learn more about them here: https://www.jfrog.com/confluence/display/JFROG/Configuring+Xray+Watches + # JF_WATCHES: ,... + + # [Optional] + # JFrog project. Learn more about it here: https://www.jfrog.com/confluence/display/JFROG/Projects + # JF_PROJECT: + + # [Optional, default: "FALSE"] + # Displays all existing vulnerabilities, including the ones that were added by the pull request. + # JF_INCLUDE_ALL_VULNERABILITIES: "TRUE" + + # [Optional, default: "TRUE"] + # Fails the Frogbot task if any security issue is found. + # JF_FAIL: "FALSE" + + From a2573a41e8b9bf804afe9976a0a89bda727d1c1d Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 14:09:14 -0500 Subject: [PATCH 2/8] Update readme --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 098c60ad..dbadfe0f 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,7 @@ Securing DevOps's invoicer ========================== + A simple REST API that manages invoices. This is the code for Chapter 2 of Securing DevOps. It only contains the code and From 27a99e8069dc70d03247dc01963c93d1bcf843eb Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 14:10:31 -0500 Subject: [PATCH 3/8] Update README --- README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/README.md b/README.md index dbadfe0f..b0f30146 100644 --- a/README.md +++ b/README.md @@ -185,3 +185,6 @@ $ curl http://172.17.0.2:8080/invoice/1 {"ID":1,"CreatedAt":"2016-05-21T15:33:21.855874Z","UpdatedAt":"2016-05-21T15:33:21.855874Z","DeletedAt":null,"is_paid":false,"amount":1664,"payment_date":"0001-01-01T00:00:00Z","due_date":"2016-05-07T23:00:00Z","charges":[{"ID":1,"CreatedAt":"2016-05-21T15:33:21.8637Z","UpdatedAt":"2016-05-21T15:33:21.8637Z","DeletedAt":null,"invoice_id":1,"type":"blood work","amount":1664,"description":"blood work"}]} ``` + + +Thanks From e807ab9d69fdb6af70aec0a2ebcfc2868c47fe22 Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 14:18:05 -0500 Subject: [PATCH 4/8] add workflow --- .github/workflow/frogbot-scan-pull-request.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflow/frogbot-scan-pull-request.yml b/.github/workflow/frogbot-scan-pull-request.yml index 0a28f13e..3d48be12 100644 --- a/.github/workflow/frogbot-scan-pull-request.yml +++ b/.github/workflow/frogbot-scan-pull-request.yml @@ -69,5 +69,3 @@ jobs: # [Optional, default: "TRUE"] # Fails the Frogbot task if any security issue is found. # JF_FAIL: "FALSE" - - From fb6fbf991dcd54ed9860453201760eb2b7d32644 Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 15:03:40 -0500 Subject: [PATCH 5/8] test --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index b0f30146..de587531 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,8 @@ This is the code for Chapter 2 of Securing DevOps. It only contains the code and scripts relevant to the basic setup of the invoicer application and infrastructure. +o + The master branch is kept at https://securing-devops.com/invoicer but if you are interested in chapter-specific versions of the invoicer. From 6bc3bf9b7edd5263d8891e17201ab26d027eeb12 Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 15:13:11 -0500 Subject: [PATCH 6/8] Updating --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index de587531..45143bb0 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,8 @@ infrastructure. o +o + The master branch is kept at https://securing-devops.com/invoicer but if you are interested in chapter-specific versions of the invoicer. From fba3e6fba1c2d304dc7e3b1530a193e0d928ec58 Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 15:38:59 -0500 Subject: [PATCH 7/8] ooooooooooo --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 45143bb0..6831faaf 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,8 @@ o o +ooooo + The master branch is kept at https://securing-devops.com/invoicer but if you are interested in chapter-specific versions of the invoicer. From 4088bbfed723ac65b102d91f85fde31a0bcf94cf Mon Sep 17 00:00:00 2001 From: Michael Xin Date: Mon, 24 Oct 2022 15:45:31 -0500 Subject: [PATCH 8/8] This is update of go --- main.go | 1 + 1 file changed, 1 insertion(+) diff --git a/main.go b/main.go index 842e34bc..78955625 100644 --- a/main.go +++ b/main.go @@ -7,6 +7,7 @@ package main //go:generate ./version.sh + import ( "encoding/json" "fmt"