Skip to content

Commit 057de4e

Browse files
anthony-nhsanthony-nhs
authored
Breaking: [AEA-0000] - Use zizmor and anchore tools (#118)
## Summary - Routine Change ### Details - use zizmor for action testing - changes to common workflows following zizmor review - use anchore tools for vulnerability testing - fix secret scan to register providers
1 parent cbb19e5 commit 057de4e

21 files changed

+116
-651
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"args": {
77
"DOCKER_GID": "${env:DOCKER_GID:}",
88
"IMAGE_NAME": "node_24_python_3_14",
9-
"IMAGE_VERSION": "v1.2.0",
9+
"IMAGE_VERSION": "v1.4.4",
1010
"USER_UID": "${localEnv:USER_ID:}",
1111
"USER_GID": "${localEnv:GROUP_ID:}"
1212
},

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# restrict access to approving workflow changes
2+
.github/workflows/ @NHSDigital/eps-admins

‎.github/workflows/combine-dependabot-prs.yml‎

Lines changed: 0 additions & 67 deletions
This file was deleted.

‎.github/workflows/dependabot-auto-approve-and-merge.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@ on:
88
AUTOMERGE_PEM:
99
required: true
1010

11-
permissions:
12-
pull-requests: write
13-
contents: write
14-
11+
permissions: {}
1512
jobs:
1613
dependabot:
1714
runs-on: ubuntu-22.04
18-
if: ${{ github.actor == 'dependabot[bot]' }}
15+
permissions:
16+
pull-requests: write
17+
contents: write
18+
if: (github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'eps-create-pull-request[bot]') && github.repository == github.event.pull_request.head.repo.full_name
1919
steps:
2020
- name: Get token from Github App
2121
id: get_app_token

‎.github/workflows/get-repo-config.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,9 +39,14 @@ on:
3939
description: Resolved digest for the supplied image reference
4040
value: ${{ jobs.verify_attestation.outputs.resolved_digest }}
4141

42+
permissions: {}
4243
jobs:
4344
get_config_values:
4445
runs-on: ubuntu-22.04
46+
permissions:
47+
attestations: read
48+
contents: read
49+
packages: read
4550
outputs:
4651
tag_format: ${{ steps.load-config.outputs.TAG_FORMAT }}
4752
devcontainer_version: ${{ steps.load-config.outputs.DEVCONTAINER_VERSION }}
@@ -51,8 +56,8 @@ jobs:
5156
- name: Checkout code
5257
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
5358
with:
54-
ref: ${{ env.BRANCH_NAME }}
5559
fetch-depth: 0
60+
persist-credentials: false
5661

5762
- name: Load config value
5863
id: load-config

‎.github/workflows/pr_title_check.yml‎

Lines changed: 1 addition & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ name: PR Title Check
33
on:
44
workflow_call:
55

6+
permissions: {}
67
jobs:
78
pr_title_format_check:
89
runs-on: ubuntu-22.04
@@ -50,43 +51,6 @@ jobs:
5051
exit 1
5152
fi
5253
53-
- name: Comment on PR with Jira Link
54-
if: steps.extract_ticket_reference.outcome == 'success' && steps.extract_ticket_reference.outputs.TICKET_REF != 'dependabot'
55-
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
56-
env:
57-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58-
TICKET_REF: ${{ steps.extract_ticket_reference.outputs.TICKET_REF }}
59-
with:
60-
message: |
61-
This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket:
62-
# [${{ env.TICKET_REF }}](https://nhsd-jira.digital.nhs.uk/browse/${{ env.TICKET_REF }})
63-
comment-tag: pr-link
64-
65-
- name: Comment on PR for dependabot
66-
if: steps.extract_ticket_reference.outcome == 'success' && steps.extract_ticket_reference.outputs.TICKET_REF == 'dependabot'
67-
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
68-
env:
69-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
70-
with:
71-
message: |
72-
This PR is raised by Dependabot to update a dependency.
73-
comment-tag: pr-link
74-
75-
- name: Comment on PR for bad format
76-
if: steps.check_prefix.outcome != 'success' || steps.check_ticket_reference.outcome != 'success'
77-
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
78-
env:
79-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
80-
with:
81-
message: |
82-
The PR title does not conform to the required format.
83-
Please ensure your PR title is prefixed with a change type (Fix, Update, New, Breaking, Docs, Build, Upgrade, Chore)
84-
and contains a ticket reference (eg. 'Fix: [AEA-####] - ...', or 'Chore: [dependabot] - ...'),
85-
then push an empty commit or recreate your PR.
86-
See the contributing guide for more details:
87-
https://github.com/NHSDigital/eps-common-workflows/blob/main/CONTRIBUTING.md
88-
comment-tag: pr-link
89-
9054
- name: Fail job due to invalid PR title format
9155
if: steps.check_prefix.outcome != 'success' || steps.check_ticket_reference.outcome != 'success'
9256
run: |

‎.github/workflows/pull_request.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,25 +7,39 @@ on:
77
env:
88
BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
99

10+
permissions: {}
1011
jobs:
1112
dependabot-auto-approve-and-merge:
1213
needs: quality_checks
1314
uses: ./.github/workflows/dependabot-auto-approve-and-merge.yml
15+
permissions:
16+
contents: write
17+
pull-requests: write
1418
secrets:
1519
AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
1620
AUTOMERGE_PEM: ${{ secrets.AUTOMERGE_PEM }}
1721

1822
pr_title_format_check:
1923
uses: ./.github/workflows/pr_title_check.yml
24+
permissions:
25+
pull-requests: write
2026

2127
get_config_values:
2228
uses: ./.github/workflows/get-repo-config.yml
29+
permissions:
30+
attestations: read
31+
contents: read
32+
packages: read
2333
with:
2434
verify_published_from_main_image: false
2535

2636
quality_checks:
2737
uses: ./.github/workflows/quality-checks-devcontainer.yml
2838
needs: [get_config_values]
39+
permissions:
40+
contents: read
41+
id-token: write
42+
packages: read
2943
with:
3044
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
3145
secrets:
@@ -43,4 +57,3 @@ jobs:
4357
pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
4458
branch_name: ${{ github.event.pull_request.head.ref }}
4559
tag_format: ${{ needs.get_config_values.outputs.tag_format }}
46-
secrets: inherit

‎.github/workflows/quality-checks-devcontainer.yml‎

Lines changed: 34 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,15 @@ on:
2525
type: string
2626
required: true
2727

28+
permissions: {}
29+
2830
jobs:
2931
quality_checks:
3032
runs-on: ubuntu-22.04
33+
permissions:
34+
contents: read
35+
id-token: write
36+
packages: read
3137
container:
3238
image: ${{ inputs.pinned_image }}
3339
options: --user 1001:1001 --group-add 128
@@ -36,16 +42,19 @@ jobs:
3642
shell: bash
3743
steps:
3844
- &init_tool_versions
39-
name: copy .tool-versions
45+
name: copy needed files from devcontainer user to runner home directory or bin directory
4046
run: |
4147
cp /home/vscode/.tool-versions "$HOME/.tool-versions"
48+
cp /home/vscode/.grant.yaml "$HOME/.grant.yaml"
49+
mkdir -p "$HOME/.local/bin"
50+
sudo cp /home/vscode/.local/bin/zizmor /usr/local/bin/zizmor
4251
4352
- &checkout
4453
name: Checkout code
4554
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
4655
with:
47-
ref: ${{ env.BRANCH_NAME }}
4856
fetch-depth: 0
57+
persist-credentials: false
4958

5059
- &setup_npmrc
5160
name: Setting up .npmrc
@@ -67,12 +76,18 @@ jobs:
6776
make install
6877
- name: Run secrets scan
6978
run: |
79+
git-secrets --register-aws
80+
git-secrets --add-provider -- cat /usr/share/secrets-scanner/nhsd-rules-deny.txt
7081
make secret-scan
7182
- name: Run actionlint
7283
run: |
7384
make actionlint
7485
75-
- name: Check language tools used and setup trivy config
86+
- name: Run zizmor
87+
run: |
88+
make zizmor
89+
90+
- name: Check language tools used
7691
id: check_languages
7792
run: |
7893
if [ -f "pyproject.toml" ] && grep -q '\[tool.poetry\]' "pyproject.toml"; then
@@ -121,14 +136,7 @@ jobs:
121136
fi
122137
- name: Check licenses
123138
run: |
124-
make trivy-license-check
125-
126-
- name: Show license scan output
127-
if: always()
128-
run: |
129-
if [ -f license_scan.txt ]; then
130-
cat .trivy_out/license_scan.txt
131-
fi
139+
make grant-scan
132140
- name: Run code lint
133141
run: |
134142
make lint
@@ -140,51 +148,19 @@ jobs:
140148
- name: Run unit tests
141149
run: |
142150
make test
143-
- name: make generate sbom
151+
- name: Generate sbom
144152
run: |
145-
make trivy-generate-sbom
153+
make syft-generate-sbom-dev-dependencies
146154
- name: Upload sbom
147155
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
148156
with:
149-
name: sbom.cdx.json
150-
path: .trivy_out/sbom.cdx.json
157+
name: sbom.dev.cdx.json
158+
path: .sbom/sbom.dev.cdx.json
151159

152-
- name: Check python vulnerabilities
153-
if: ${{ steps.check_languages.outputs.uses_poetry == 'true' }}
154-
continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
160+
- name: Check vulnerabilities
155161
run: |
156-
make trivy-scan-python
162+
make grype-scan-dev-dependencies
157163
158-
- name: Check node vulnerabilities
159-
if: ${{ steps.check_languages.outputs.uses_node == 'true' }}
160-
continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
161-
run: |
162-
make trivy-scan-node
163-
- name: Check go vulnerabilities
164-
if: ${{ steps.check_languages.outputs.uses_go == 'true' }}
165-
continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
166-
run: |
167-
make trivy-scan-go
168-
- name: Check java vulnerabilities
169-
if: ${{ steps.check_languages.outputs.uses_java == 'true' }}
170-
continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
171-
run: |
172-
make trivy-scan-java
173-
- name: Show vulnerability output
174-
if: always()
175-
run: |
176-
if [ -f .trivy_out/dependency_results_python.txt ]; then
177-
cat .trivy_out/dependency_results_python.txt
178-
fi
179-
if [ -f .trivy_out/dependency_results_node.txt ]; then
180-
cat .trivy_out/dependency_results_node.txt
181-
fi
182-
if [ -f .trivy_out/dependency_results_java.txt ]; then
183-
cat .trivy_out/dependency_results_java.txt
184-
fi
185-
if [ -f .trivy_out/dependency_results_go.txt ]; then
186-
cat .trivy_out/dependency_results_go.txt
187-
fi
188164
- name: "check is SONAR_TOKEN exists"
189165
env:
190166
super_secret: ${{ secrets.SONAR_TOKEN }}
@@ -279,6 +255,10 @@ jobs:
279255
echo "images=$NORMALIZED" >> "$GITHUB_OUTPUT"
280256
281257
docker_vulnerability_scan:
258+
permissions:
259+
contents: read
260+
id-token: write
261+
packages: read
282262
runs-on: ubuntu-22.04
283263
needs: get_docker_images_to_scan
284264
container:
@@ -310,19 +290,15 @@ jobs:
310290
- name: Check docker vulnerabilities
311291
continue-on-error: ${{ github.actor == 'dependabot[bot]' }}
312292
run: |
313-
make trivy-scan-docker
293+
make grype-scan-docker-image
314294
env:
315295
DOCKER_IMAGE: ${{ matrix.docker_image }}
316296

317-
- name: Show docker vulnerability output
318-
if: always()
319-
run: |
320-
echo "Scan output for ${{ matrix.docker_image }}"
321-
if [ -f .trivy_out/dependency_results_docker.txt ]; then
322-
cat .trivy_out/dependency_results_docker.txt
323-
fi
324-
325297
IaC-validation:
298+
permissions:
299+
contents: read
300+
id-token: write
301+
packages: read
326302
runs-on: ubuntu-22.04
327303
container:
328304
image: ${{ inputs.pinned_image }}

0 commit comments

Comments
 (0)