chore: update based comments

entur · Oct 15, 2024 · f207ced · f207ced
1 parent 351510b
commit f207ced
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 14 deletions.
diff --git a/.github/workflows/code-scan.yml b/.github/workflows/code-scan.yml
@@ -8,6 +8,10 @@ on:
           default: false
           required: false
           type: boolean
+      secrets:
+        external_repository_token:
+          description: 'Token to access the external repository mentioned in the codescan.yml file. Must have read access to the repository.'
+          required: false
 env:
   GITHUB_REPOSITORY: ${{ github.repository }}
 
@@ -339,7 +343,7 @@ jobs:
               'Authorization': f'token {external_token}'
             }
 
-            for file_name in 'code_scan_config.yml', 'code_scan_config.yaml':
+            for file_name in _config_file_names:
               response = requests.get(f'https://api.github.com/repos/entur/{external_repository}/contents/{_file_location}/{file_name}', headers=headers)
               if response.status_code != 404 and response.status_code != 200:
                 print(f'::error ::Could not get external allowlist file ({response.status_code} - {response.reason})')
@@ -351,7 +355,7 @@ jobs:
               print(f'::notice ::External allowlist file not found')
 
           if external_allowlist:
-            with open(os.path.join(_file_location, 'external_code_scan_config.yml'), 'w') as f:
+            with open(os.path.join(_file_location, 'external_codescan.yml'), 'w') as f:
               f.write(base64.b64decode(response.json().get('content','')).decode('utf-8'))
                 
           with open(env_file, 'a') as f:
@@ -374,7 +378,7 @@ jobs:
           _file_location = '.entur/security'
 
           schema = {
-              'apiVersion': {'type': 'string', 'required': True},
+              'apiVersion': {'type': 'string', 'required': True, 'allowed': 'entur.io/securitytools/v1'},
               'kind': {'type': 'string', 'required': True, 'allowed': ['CodeScanConfig']},
               'metadata': {
                   'type': 'dict', 
@@ -393,7 +397,6 @@ jobs:
                       'allowlist': {
                           'required' : False,
                           'type': 'list',
-                          'minlength': 1,
                           'schema': {
                               'type': 'dict',
                               'schema': {
@@ -430,7 +433,7 @@ jobs:
           if os.getenv('GHA_SECURITY_CODE_SCAN_EXTERNAL_ALLOWLIST') == 'True':  
             data = ''
             try:
-              with open(os.path.join(_file_location, 'external_code_scan_config.yml'), 'r') as f:
+              with open(os.path.join(_file_location, 'external_codescan.yml'), 'r') as f:
                 data = yaml.safe_load(f)
             except IOError:
               print('::error ::External allowlist file not found')
@@ -472,7 +475,7 @@ jobs:
           }
 
           try:
-            with open(os.path.join(_file_location, 'external_code_scan_config.yml'), 'r') as f: 
+            with open(os.path.join(_file_location, 'external_codescan.yml'), 'r') as f: 
               remote_config = yaml.safe_load(f)
 
               for element in remote_config.get('spec', {}).get('allowlist', []):

diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml
@@ -9,7 +9,7 @@ on:
                 required: true
         secrets:
             external_repository_token:
-                description: 'Token to access the external repository mentioned in the docker_scan_config.yml file. Must have read access to the repository.'
+                description: 'Token to access the external repository mentioned in the dockerscan.yml file. Must have read access to the repository.'
                 required: false
 
 env:
@@ -60,7 +60,7 @@ jobs:
             _config_file_names = ('dockerscan.yml', 'dockerscan.yaml')
             _file_location = '.entur/security'
 
-            for file_name in :
+            for file_name in _config_file_names:
                 try:
                   with open(os.path.join(_file_location, file_name), 'r') as f:
                     external_repository = yaml.safe_load(f).get('spec', {}).get('inherit','')
@@ -92,7 +92,7 @@ jobs:
                 print(f'::notice ::External allowlist file not found')
 
             if external_allowlist:
-              with open(os.path.join(_file_location, 'external_docker_scan_config.yml'), 'w') as f:
+              with open(os.path.join(_file_location, 'external_dockerscan.yml'), 'w') as f:
                 f.write(base64.b64decode(response.json().get('content','')).decode())
 
             with open(env_file, 'a') as f:
@@ -115,7 +115,7 @@ jobs:
             _file_location = '.entur/security'
 
             schema = {
-              'apiVersion': {'type': 'string', 'required': True},
+              'apiVersion': {'type': 'string', 'required': True, 'allowed': 'entur.io/securitytools/v1'},
               'kind': {'type': 'string', 'required': True, 'allowed': ['DockerScanConfig']},
               'metadata': {
                   'type': 'dict', 
@@ -134,7 +134,6 @@ jobs:
                       'allowlist': {
                           'required': False,
                           'type': 'list',
-                          'minlength': 1,
                           'schema': {
                               'type': 'dict',
                               'schema': {
@@ -170,7 +169,7 @@ jobs:
             if os.getenv('GHA_SECURITY_DOCKER_SCAN_EXTERNAL_ALLOWLIST') == 'True':  
               data = ''
               try:
-                with open(os.path.join(_file_location, 'external_docker_scan_config.yml'), 'r') as f:
+                with open(os.path.join(_file_location, 'external_dockerscan.yml'), 'r') as f:
                   data = yaml.safe_load(f)
               except IOError:
                 print('::error ::External allowlist file not found')
@@ -196,7 +195,7 @@ jobs:
             allowlist = {}
 
             try:
-              with open(os.path.join(_file_location, 'external_docker_scan_config'), 'r') as f:
+              with open(os.path.join(_file_location, 'external_dockerscan'), 'r') as f:
                 remote_config = yaml.safe_load(f)
 
                 for element in remote_config.get('spec', {}).get('allowlist', []):

diff --git a/README-code-scan.md b/README-code-scan.md
@@ -169,7 +169,7 @@ spec:
 
 Some potential pitfalls and solutions with CodeQL
 
-### Autobuild fails for Gradle projects because of JVM versions
+### Autobuild fails for Gradle projects because of JVM version mismatch
 
 This can happen if Autobuild detects the wrong version of the JVM to run Gradle with. This can be solved by statically setting the JVM version in the Gradle toolchain: