Fix!: setup gradle run and allow lists #42

cvaskinn · 2024-10-10T10:36:22Z

Fixes bug with setup gradle running even when not supposed to.
Allowlist adhere to new spec.
Cleanup of documentation.
Added support for ARTIFACTORY_URL.
Added support for new artifactory token. Closes: API_KEY is deprecated, add ARTIFACTORY_AUTH_TOKEN #41
Only prints setup-gradle summary on failure

BREAKING CHANGES:

Old allowlists will stop working

EnturWilhelm · 2024-10-14T08:16:50Z

.github/workflows/code-scan.yml

                      'allowlist': {
+                          'required' : False,
                          'type': 'list',
                          'minlength': 1,


'minlength': 1 kan fjernes. Allowlist vil nok endre seg over tid, så det kan hende at utviklere har satt en tom allowlist fra en tid til en annen.

EnturWilhelm · 2024-10-14T08:19:56Z

.github/workflows/docker-scan.yml

          run: |
            python -c "
            import yaml
            from cerberus import Validator
            import sys
            import os

+            _config_file_names = ('dockerscan.yml', 'dockerscan.yaml')
+            _file_location = '.entur/security'
+
            schema = {
              'apiVersion': {'type': 'string', 'required': True},


Sett allowed values til entur.io/securitytools/v1 (https://docs.python-cerberus.org/validation-rules.html#allowed)

EnturWilhelm · 2024-10-14T08:22:22Z

README-code-scan.md

+
+Some potential pitfalls and solutions with CodeQL
+
+### Autobuild fails for Gradle projects because of JVM versions


### Autobuild fails for Gradle projects because of JVM versions
->
### Autobuild fails for Gradle projects because of JVM version mismatch

EnturWilhelm · 2024-10-14T08:31:33Z

.github/workflows/code-scan.yml

@@ -363,22 +370,28 @@ jobs:
          import sys
          import os

+          _config_file_names = ('codescan.yml', 'codescan.yaml')
+          _file_location = '.entur/security'
+
          schema = {
              'apiVersion': {'type': 'string', 'required': True},


Sett allowed values til entur.io/securitytools/v1 (https://docs.python-cerberus.org/validation-rules.html#allowed)

EnturWilhelm · 2024-10-14T08:33:22Z

.github/workflows/code-scan.yml

@@ -332,8 +339,8 @@ jobs:
              'Authorization': f'token {external_token}'
            }

-            for file_name in ('code_scan_config.yml', 'code_scan_config.yaml'):
-              response = requests.get(f'https://api.github.com/repos/entur/{external_repository}/contents/{file_name}', headers=headers)
+            for file_name in 'code_scan_config.yml', 'code_scan_config.yaml':


-> for file_name in _config_file_names:

EnturWilhelm · 2024-10-14T08:37:00Z

.github/workflows/docker-scan.yml

@@ -158,7 +170,7 @@ jobs:
            if os.getenv('GHA_SECURITY_DOCKER_SCAN_EXTERNAL_ALLOWLIST') == 'True':  
              data = ''
              try:
-                with open('external_docker_scan_config.yml', 'r') as f:
+                with open(os.path.join(_file_location, 'external_docker_scan_config.yml'), 'r') as f:


Rename filen til external_dockerscan.yml.

Ikke noe problem, men hva er argumentasjonen for å bytte navnet når den har hatt det siden starten?

Ikke noe annen grunn enn at det gir mer mening når man leser koden. I.e. det er enklere å skjønne at det er en kopi av codescan.yml som hentes eksternt.

EnturWilhelm · 2024-10-14T08:37:05Z

.github/workflows/docker-scan.yml

            allowlist = {}

            try:
-              with open('external_docker_scan_config', 'r') as f:
+              with open(os.path.join(_file_location, 'external_docker_scan_config'), 'r') as f:


Rename filen til external_dockerscan.yml. Er forsåvidt også en bug her i originalen (.yml extension mangler).

.github/workflows/code-scan.yml

EnturWilhelm · 2024-10-14T08:50:15Z

.github/workflows/docker-scan.yml

+            _config_file_names = ('dockerscan.yml', 'dockerscan.yaml')
+            _file_location = '.entur/security'
+
+            for file_name in :


Antar du mener for file_name in _config_file_names:

.github/workflows/docker-scan.yml

Documentation and both WFs have been updated to reflect requirements in spec.

Docker Scan didn't have access to the external_repository_token as the environment variable wasn't set.

EnturWilhelm

Fix this then we good.

EnturWilhelm · 2024-10-15T08:28:14Z

.github/workflows/docker-scan.yml

            allowlist = {}

            try:
-              with open('external_docker_scan_config', 'r') as f:
+              with open(os.path.join(_file_location, 'external_dockerscan'), 'r') as f:


Mangler .yml extension.

cvaskinn added 6 commits October 9, 2024 14:09

fix: setup-gradle job summary only prints on failure.

c747840

fix: Gradle-setup only runs when requested

f8426f8

chore: Boolean is actually treated correctly

bd0b7e0

chore: remove curly brackets

34d34a8

docs: Updated with troubleshoot information

6114f6f

docs: new schema for allowlist

259b122

cvaskinn requested a review from a team as a code owner October 10, 2024 10:36

cvaskinn changed the title ~~Fix/setup gradle run and allow lists~~ Fix: setup gradle run and allow lists Oct 10, 2024

cvaskinn changed the title ~~Fix: setup gradle run and allow lists~~ Fix!: setup gradle run and allow lists Oct 11, 2024

EnturWilhelm requested changes Oct 14, 2024

View reviewed changes

cvaskinn requested a review from EnturWilhelm October 15, 2024 07:58

cvaskinn added 7 commits October 15, 2024 10:13

fix!: Allowlists adhere to spec

bee629a

Documentation and both WFs have been updated to reflect requirements in spec.

fix: support new artifactory token

ae787c4

fix: support artifactory_url from org variables

8ad8833

docs: update readme link

d87b4a9

fix: access token missing in docker scan

2e9730b

Docker Scan didn't have access to the external_repository_token as the environment variable wasn't set.

fix: Added ARTIFACTORY_AUTH_USER as env variable for autobuild.

0067c73

chore: update based comments

9a593d3

cvaskinn force-pushed the fix/setup_gradle_run branch from f207ced to 9a593d3 Compare October 15, 2024 08:13

EnturWilhelm approved these changes Oct 15, 2024

View reviewed changes

chore: added yml where missing

325049e

cvaskinn merged commit 9039eed into main Oct 15, 2024
2 checks passed

cvaskinn deleted the fix/setup_gradle_run branch October 15, 2024 08:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix!: setup gradle run and allow lists #42

Fix!: setup gradle run and allow lists #42

cvaskinn commented Oct 10, 2024 •

edited

Loading

EnturWilhelm Oct 14, 2024

EnturWilhelm Oct 14, 2024

EnturWilhelm Oct 14, 2024

EnturWilhelm Oct 14, 2024

EnturWilhelm Oct 14, 2024

EnturWilhelm Oct 14, 2024

cvaskinn Oct 15, 2024

EnturWilhelm Oct 15, 2024

EnturWilhelm Oct 14, 2024

EnturWilhelm Oct 14, 2024

EnturWilhelm left a comment

EnturWilhelm Oct 15, 2024


		Some potential pitfalls and solutions with CodeQL

		### Autobuild fails for Gradle projects because of JVM versions

Fix!: setup gradle run and allow lists #42

Fix!: setup gradle run and allow lists #42

Conversation

cvaskinn commented Oct 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

EnturWilhelm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cvaskinn commented Oct 10, 2024 •

edited

Loading