agent-plugins/.github/workflows/security-scanners.yml at main · awslabs/agent-plugins

442 lines (429 loc) · 18.5 KB
name: Security Scanners
  schedule:
    # Daily at 15:12 UTC (random time to avoid GitHub Actions load spikes)
    - cron: '12 15 * * *'
  workflow_dispatch:
    branches: [main]
  pull_request:
    branches: [main]
permissions:
  actions: none
  attestations: none
  checks: none
  contents: none
  deployments: none
  discussions: none
  id-token: none
  issues: none
  models: none
  packages: none
  pages: none
  pull-requests: none
  repository-projects: none
  security-events: none
  statuses: none
  gitleaks:
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
      GITLEAKS_VERSION: "8.30.0"
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
      - name: Install gitleaks
        run: |
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz;
          sudo mv gitleaks /usr/local/bin/;
          gitleaks --version;
      - name: Run gitleaks (full history)
        id: gitleaks
        run: |
          set +e
          gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json --report-path=gitleaks-report_sarif.json --report-format=sarif .
          GITLEAKS_EXIT=$?
          set -e
          echo "exit_code=$GITLEAKS_EXIT" >> "$GITHUB_OUTPUT"
          exit 0
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: gitleaks.sarif
          path: gitleaks-report_sarif.json
          if-no-files-found: error
      - uses: github/codeql-action/upload-sarif@5e7a52feb2a3dfb87f88be2af33b9e2275f48de6 # v4.32.2
        continue-on-error: true
        with:
          sarif_file: gitleaks-report_sarif.json
      - if: steps.gitleaks.outputs.exit_code != '0'
        run: |
          echo "::error::gitleaks found secrets"
          exit ${{ steps.gitleaks.outputs.exit_code }}  # nosemgrep: yaml.github-actions.security.curl-eval.curl-eval
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - run: |
          echo "bandit[sarif]==1.9.3" > requirements.txt
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.x'
          cache: 'pip'
      - name: Run bandit
        id: bandit
        run: |
          pip install -r requirements.txt
          rm requirements.txt
          set +e
          bandit -r . -f sarif -o bandit-report_sarif.json
          BANDIT_EXIT=$?
          set -e
          echo "exit_code=$BANDIT_EXIT" >> "$GITHUB_OUTPUT"
          exit 0
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: bandit.sarif
          path: bandit-report_sarif.json
          if-no-files-found: error
      - uses: github/codeql-action/upload-sarif@5e7a52feb2a3dfb87f88be2af33b9e2275f48de6 # v4.32.2
        continue-on-error: true
        with:
          sarif_file: bandit-report_sarif.json
      - if: steps.bandit.outputs.exit_code != '0'
        run: |
          echo "::error::bandit found security issues"
          exit ${{ steps.bandit.outputs.exit_code }}  # nosemgrep: yaml.github-actions.security.curl-eval.curl-eval
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
      - run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/43e7e3246ed01b1ec0ff54f9b054201ccbe78e3a/install.sh | sh -s -- -b /usr/local/bin v0.104.3
          grype --version
      - name: Run grype
        id: grype
        run: |
          set +e
          grype --output sarif . | tee grype-report_sarif.json
          GRYPE_EXIT=${PIPESTATUS[0]}
          set -e
          echo "exit_code=$GRYPE_EXIT" >> "$GITHUB_OUTPUT"
          exit 0
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: grype.sarif
          path: grype-report_sarif.json
          if-no-files-found: error
      - uses: github/codeql-action/upload-sarif@5e7a52feb2a3dfb87f88be2af33b9e2275f48de6 # v4.32.2
        continue-on-error: true
        with:
          sarif_file: grype-report_sarif.json
      - if: steps.grype.outputs.exit_code != '0'
        run: |
          echo "::error::grype found vulnerabilities"
          exit ${{ steps.grype.outputs.exit_code }}  # nosemgrep: yaml.github-actions.security.curl-eval.curl-eval
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
      - run: |
          echo "checkov==3.2.500" > requirements.txt
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.x'
          cache: 'pip'
      - name: Run checkov
        id: checkov
        run: |
          pip install -r requirements.txt
          rm requirements.txt
          set +e
          checkov -d . --output sarif --output-file-path .
          CHECKOV_EXIT=$?
          mv results_sarif.sarif checkov-report_sarif.json || true
          set -e
          echo "exit_code=$CHECKOV_EXIT" >> "$GITHUB_OUTPUT"
          exit 0
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: checkov.sarif
          path: checkov-report_sarif.json
          if-no-files-found: error
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@5e7a52feb2a3dfb87f88be2af33b9e2275f48de6 # v4.32.2
        continue-on-error: true
        with:
          sarif_file: checkov-report_sarif.json
      - if: steps.checkov.outputs.exit_code != '0'
        run: |
          echo "::error::checkov found IaC issues"
          exit ${{ steps.checkov.outputs.exit_code }}  # nosemgrep: yaml.github-actions.security.curl-eval.curl-eval
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0 # Required for baseline comparison
      - run: |
          echo "semgrep==1.151.0" > requirements.txt
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.x'
          cache: 'pip'
      - run: |
          pip install -r requirements.txt
          rm requirements.txt
      - name: Run semgrep
        id: semgrep
        env:
          # For PRs: base SHA; for push to default branch: empty
          BASELINE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
        run: |
            BASELINE_ARGS=""
            if [ -n "$BASELINE_SHA" ]; then
              BASELINE_ARGS="--baseline-commit $BASELINE_SHA"
            # Run semgrep, capture exit code
            # Rule exclusions documented in .semgrep.yaml
            set +e
            semgrep scan --oss-only --verbose --metrics=off --config=r/all \
              --max-log-list-entries=0 \
              --exclude-rule="ai.generic.detect-generic-ai-anthprop.detect-generic-ai-anthprop" \
              --exclude-rule="generic.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-key" \
              --exclude-rule="apex.lang.best-practice.ncino.accessmodifiers.globalaccessmodifiers.global-access-modifiers" \
              --exclude-rule="apex.lang.best-practice.ncino.urls.absoluteurls.absolute-urls" \
              --exclude-rule="apex.lang.security.ncino.dml.apexcsrfconstructor.apex-csrf-constructor" \
              --exclude-rule="apex.lang.security.ncino.dml.dmlnativestatements.dml-native-statements" \
              --exclude-rule="apex.lang.security.ncino.encryption.badcrypto.bad-crypto" \
              --exclude-rule="apex.lang.security.ncino.endpoints.insecurehttprequest.insecure-http-request" \
              --exclude-rule="apex.lang.security.ncino.endpoints.namedcredentialsconstantmatch.named-credentials-constant-match" \
              --exclude-rule="apex.lang.security.ncino.endpoints.namedcredentialsstringmatch.named-credentials-string-match" \
              --exclude-rule="apex.lang.security.ncino.injection.apexsoqlinjectionfromunescapedurlparam.soql-injection-unescaped-url-param" \
              --exclude-rule="apex.lang.security.ncino.injection.apexsoqlinjectionunescapedparam.soql-injection-unescaped-param" \
              --exclude-rule="apex.lang.security.ncino.sharing.specifysharinglevel.specify-sharing-level" \
              --exclude-rule="apex.lang.security.ncino.system.systemdebug.system-debug" \
              --exclude-rule="elixir.lang.best-practice.deprecated-bnot-operator.deprecated_bnot_operator" \
              --exclude-rule="elixir.lang.best-practice.deprecated-bxor-operator.deprecated_bxor_operator" \
              --exclude-rule="elixir.lang.best-practice.deprecated-calendar-iso-day-of-week-3.deprecated_calendar_iso_day_of_week_3" \
              --exclude-rule="elixir.lang.best-practice.deprecated-use-bitwise.deprecated_use_bitwise" \
              --exclude-rule="elixir.lang.best-practice.enum-map-into.enum_map_into" \
              --exclude-rule="elixir.lang.best-practice.enum-map-join.enum_map_join" \
              --exclude-rule="elixir.lang.correctness.atom-exhaustion.atom_exhaustion" \
              --sarif-output semgrep-report_sarif.json $BASELINE_ARGS
            SEMGREP_EXIT=$?
            set -e
            echo "exit_code=$SEMGREP_EXIT" >> "$GITHUB_OUTPUT"
            # Exit 0 for now to allow artifact upload
            exit 0
      - name: Fix SARIF for GitHub compatibility
        continue-on-error: true
        run: |
          # Fix 1: Convert text security-severity to numeric (CVSS 0.0-10.0)
          # Semgrep outputs: Info, Low, Medium, High, Critical
          # GitHub expects: numeric values
          sed -i \
            -e 's/"security-severity":"Info"/"security-severity":"0.0"/gI' \
            -e 's/"security-severity":"Low"/"security-severity":"2.0"/gI' \
            -e 's/"security-severity":"Medium"/"security-severity":"5.0"/gI' \
            -e 's/"security-severity":"High"/"security-severity":"7.0"/gI' \
            -e 's/"security-severity":"Critical"/"security-severity":"9.0"/gI' \
            semgrep-report_sarif.json
          # Fix 2: Truncate rule IDs exceeding 255 characters
          # GitHub rejects SARIF with identifiers > 255 chars
          jq '
            # Build a mapping of old IDs to new (truncated) IDs
            (.runs[0].tool.driver.rules // []) as $rules |
            ([$rules[] | select((.id | length) > 255) |
              {key: .id, value: (.id[0:247] + "-" + (.id | @base64 | gsub("[+/]"; "_") | .[0:7]))}
            ] | from_entries) as $id_map |
            # Update rule definitions
            .runs[0].tool.driver.rules = [
              $rules[] |
              if (.id | length) > 255 then
                .id = $id_map[.id] |
                .name = $id_map[.name] // .name
              else . end
            # Update result references
            .runs[0].results = [
              (.runs[0].results // [])[] |
              if (.ruleId | length) > 255 then
                .ruleId = $id_map[.ruleId]
              else . end
          ' semgrep-report_sarif.json > semgrep.sarif.tmp.json && mv semgrep.sarif.tmp.json semgrep-report_sarif.json
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: semgrep.sarif
          path: semgrep-report_sarif.json
          if-no-files-found: error
      - uses: github/codeql-action/upload-sarif@5e7a52feb2a3dfb87f88be2af33b9e2275f48de6 # v4.32.2
        continue-on-error: true
        with:
          sarif_file: semgrep-report_sarif.json
      - if: steps.semgrep.outputs.exit_code != '0'
        run: |
          echo "::error::semgrep found new security issues"
          exit ${{ steps.semgrep.outputs.exit_code }}  # nosemgrep: yaml.github-actions.security.curl-eval.curl-eval
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
    services:
      clamav:
        image: clamav/clamav@sha256:a56287b4ffa299bde2ef09234cb8b6134d591d0be05b63f5065932dc93cb2435
        ports:
        options: >-
          --health-cmd "/usr/local/bin/clamdcheck.sh"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Wait for ClamAV service
        run: timeout 300 bash -c 'until echo > /dev/tcp/localhost/3310; do sleep 5; done' 2>/dev/null
      - run: |
          sudo apt-get update || true
          sudo rm -f /var/lib/man-db/auto-update
          sudo apt-get install -y --no-install-recommends clamdscan
          sudo mkdir -p /etc/clamav
          cat << EOF | sudo tee /etc/clamav/clamd.conf
          TCPSocket 3310
          TCPAddr 127.0.0.1
          EOF
          clamdscan --version
      - run: |
          clamdscan --verbose --log=clamdscan.txt --stream --fdpass --multiscan .
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: always()
        with:
          name: clamdscan.txt
          path: clamdscan.txt
          if-no-files-found: error
  sonarqube:
    permissions:
      actions: read
      contents: read
      security-events: write
    runs-on: ubuntu-latest
    services:
      sonarqube:
        image: sonarqube:community@sha256:48dd0e946ad6481dde43bb31d1a7af09c22f59be6399b195dcce7b87d82c5f40
        ports:
        env:
          SONAR_ES_BOOTSTRAP_CHECKS_DISABLE: true
          SONAR_WEB_SYSTEMPASSCODE: passcode # is it possible to make this dynamic?
        # nosemgrep: trailofbits.generic.wget-unencrypted-url.wget-unencrypted-url (localhost doesn't need HTTPS)
        options: >-
          --health-cmd "status=$(wget -qO- http://localhost:9000/api/system/status | grep -oP '(?<=status\":\").*' | sed -e 's|\"}||' | tr -d '\n'); echo -n \"$status\"; test \"$status\" = \"UP\"  # nosemgrep: trailofbits.generic.wget-unencrypted-url.wget-unencrypted-url"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 30
    # - if: always()
    #   run: |
    #     docker inspect $(docker ps -qf "ancestor=sonarqube:community@sha256:48dd0e946ad6481dde43bb31d1a7af09c22f59be6399b195dcce7b87d82c5f40") | jq '.[] | {"test": .Config.Healthcheck.Test, "state": .State.Health}'
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        fetch-depth: 0
    - name: Wait for SonarQube to be ready
      run: |
        until curl --silent http://localhost:9000/api/system/status | jq -r '.status' | grep -q 'UP'; do
          echo "Waiting for SonarQube..."
          sleep 5
        done
        echo "SonarQube is ready!"
    - name: Get SonarQube token
      run: |
        # Login and get token (default credentials: admin/admin)
        SONAR_TOKEN=$(curl -s -u admin:admin -X POST "http://localhost:9000/api/user_tokens/generate?name=github-actions" \
          | jq -r '.token')
        echo "SONAR_TOKEN=$SONAR_TOKEN" >> $GITHUB_ENV
    - name: SonarQube Info
      run: |
        curl --silent --request GET \
          --url 'http://localhost:9000/api/server/version' \
          --header 'X-Sonar-Passcode: passcode'
        curl --silent --request GET \
          --url 'http://localhost:9000/api/system/health' \
          --header 'X-Sonar-Passcode: passcode' | jq
        curl --silent --request GET \
          --url 'http://localhost:9000/api/system/info' \
          --header 'Authorization: Bearer ${{ env.SONAR_TOKEN }}' | jq
    # TODO: Shouldn't the project be matching the repo and name?
    - name: Create SonarQube project
      run: |
        # Create project
        curl --silent --request POST \
          --url "http://localhost:9000/api/projects/create?project=my-project&name=MyProject" \
          --header 'Authorization: Bearer ${{ env.SONAR_TOKEN }}'
    - uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6.0.0
      id: sonarqube-scan-action
        SONAR_HOST_URL: http://localhost:9000
        SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
      with:
        args: >
          "-Dsonar.projectName=MyProject"
          -Dsonar.projectKey=my-project
          -Dsonar.sources=.
          -Dsonar.verbose=true
    # If you wish to fail your job when the Quality Gate is red, uncomment the
    # following lines. This would typically be used to fail a deployment.
    - uses: SonarSource/sonarqube-quality-gate-action@cf038b0e0cdecfa9e56c198bbb7d21d751d62c3b # v1.2.0
      id: sonarqube-quality-gate-check
      timeout-minutes: 5 # why 4 minutes?
        SONAR_HOST_URL: http://localhost:9000
        SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
    # Use the output from the Quality Gate in another step.
    # The possible outputs of the `quality-gate-status` variable are `PASSED`, `WARN`, or `FAILED`.
    - name: "Example show SonarQube Quality Gate Status value"
      if: always()
      run: |
        echo "The Quality Gate status is ${{ steps.sonarqube-quality-gate-check.outputs.quality-gate-status }}"  # nosemgrep: yaml.github-actions.security.curl-eval.curl-eval
        find . -name "report-task.txt" -print0 | xargs -0 -I{} cat {}
    - name: Get Issues
      run: |
        curl --silent --request GET \
          --url 'http://localhost:9000/api/issues/search?componentKeys=my-project&ps=500&p=1' \
          --header 'Authorization: Bearer ${{ env.SONAR_TOKEN }}' | tee sonar-issues.json | jq || exit 1
    - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      if: always()
      with:
          name: sonar-issues.json
          path: sonar-issues.json
          if-no-files-found: error
        # TODO: write a loop and write the JSON artifact out
        # TODO: convert the artifact to a SARIF format
        # http://localhost:9000/api/issues/search?componentKeys=AWS-Labs-MCP-Servers
        # https://next.sonarqube.com/sonarqube/web_api/api/project_analyses/search
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

security-scanners.yml

Latest commit

History

security-scanners.yml

File metadata and controls
