FilesExpand file tree

 main

/

devsecops-pipeline.yml

Copy path

View Runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

434 lines (367 loc) · 12.8 KB

 main

/

devsecops-pipeline.yml

Top

File metadata and controls

• Code
• Blame

434 lines (367 loc) · 12.8 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

name: DevSecOps Pipeline

on:

push:

branches: [ main, master, develop ]

pull_request:

branches: [ main, master, develop ]

workflow_dispatch:

env:

REGISTRY: ghcr.io

IMAGE_NAME: ${{ github.repository_owner }}/solar-system

DOCKER_IMAGE_TAG: ${{ github.sha }}

jobs:

# Stage 1: Code Checkout and Dependency Installation

build-and-test:

name: Build and Unit Tests

runs-on: ubuntu-latest

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Setup Node.js

uses: actions/setup-node@v4

with:

node-version: '18'

cache: 'npm'

- name: Install dependencies

run: npm install

- name: Run unit tests

run: npm test

continue-on-error: false # Fail pipeline if tests fail

env:

MONGO_URI: ${{ secrets.MONGO_URI }}

- name: Upload test results

if: always()

uses: actions/upload-artifact@v4

with:

name: test-results

path: test-results.xml

# Stage 2: Code Coverage

code-coverage:

name: Code Coverage Analysis

runs-on: ubuntu-latest

needs: build-and-test

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Setup Node.js

uses: actions/setup-node@v4

with:

node-version: '18'

cache: 'npm'

- name: Install dependencies

run: npm install

- name: Run coverage analysis

run: npm run coverage

env:

MONGO_URI: ${{ secrets.MONGO_URI }}

- name: Upload coverage reports

uses: actions/upload-artifact@v4

with:

name: coverage-reports

path: |

coverage/

.nyc_output/

# Stage 3: SAST - Static Application Security Testing

sast-semgrep:

name: SAST - Semgrep

runs-on: ubuntu-latest

permissions:

contents: read

security-events: write

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Install Semgrep

run: pip3 install semgrep

- name: Run Semgrep scan - JSON output

continue-on-error: true

run: |

semgrep --config "p/security-audit" --config "p/nodejs" --config "p/owasp-top-ten" --config "p/javascript" --json --output semgrep-results.json . || echo "Semgrep JSON scan completed"

- name: Run Semgrep scan - SARIF output

continue-on-error: true

run: |

semgrep --config "p/security-audit" --config "p/nodejs" --config "p/owasp-top-ten" --config "p/javascript" --sarif --output semgrep-results.sarif . || echo "Semgrep SARIF scan completed"

- name: Run Semgrep scan - Text output

continue-on-error: true

run: |

semgrep --config "p/security-audit" --config "p/nodejs" --config "p/owasp-top-ten" --config "p/javascript" --text . > semgrep-results.txt 2>&1 || echo "Semgrep text scan completed"

- name: Upload Semgrep results to GitHub Security

uses: github/codeql-action/upload-sarif@v3

if: always()

with:

sarif_file: 'semgrep-results.sarif'

category: 'semgrep'

- name: Upload Semgrep results

if: always()

uses: actions/upload-artifact@v4

with:

name: semgrep-results

path: |

semgrep-results.json

semgrep-results.sarif

semgrep-results.txt

# Stage 4: Dependency Scanning

dependency-scan:

name: Dependency Scanning - Snyk

runs-on: ubuntu-latest

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Setup Node.js

uses: actions/setup-node@v4

with:

node-version: '18'

- name: Install dependencies

run: npm install

- name: Run Snyk to check for vulnerabilities

uses: snyk/actions/node@master

continue-on-error: true

env:

SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

with:

args: --severity-threshold=high --json-file-output=snyk-results.json

- name: Generate Snyk HTML report

if: always()

continue-on-error: true

run: |

npx snyk test --severity-threshold=high > snyk-results.txt 2>&1 || true

npx snyk-to-html -i snyk-results.json -o snyk-results.html || echo "HTML generation skipped"

env:

SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

- name: Upload Snyk results

if: always()

uses: actions/upload-artifact@v4

with:

name: snyk-results

path: |

snyk-results.json

snyk-results.html

snyk-results.txt

- name: Run npm audit

run: npm audit --json > npm-audit-results.json

continue-on-error: true

- name: Upload npm audit results

if: always()

uses: actions/upload-artifact@v4

with:

name: npm-audit-results

path: npm-audit-results.json

# Stage 5: Secret Detection

secret-scan:

name: Secret Detection - TruffleHog

runs-on: ubuntu-latest

steps:

- name: Checkout code

uses: actions/checkout@v4

with:

fetch-depth: 0 # Full history for secret scanning

- name: TruffleHog OSS

uses: trufflesecurity/trufflehog@main

continue-on-error: true # Don't fail pipeline on secrets found

with:

path: ./

base: ${{ github.event.before || '' }}

head: ${{ github.sha }}

extra_args: --only-verified

# Stage 6: Docker Build and Push

docker-build:

name: Docker Build and Push

runs-on: ubuntu-latest

needs: [build-and-test, code-coverage, sast-semgrep, dependency-scan, secret-scan]

permissions:

contents: read

packages: write

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Set up Docker Buildx

uses: docker/setup-buildx-action@v3

- name: Log in to GitHub Container Registry

uses: docker/login-action@v3

with:

registry: ${{ env.REGISTRY }}

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

- name: Extract metadata for Docker

id: meta

uses: docker/metadata-action@v5

with:

images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

tags: |

type=sha,prefix={{branch}}-

type=ref,event=branch

type=ref,event=pr

type=semver,pattern={{version}}

type=semver,pattern={{major}}.{{minor}}

type=raw,value=latest,enable={{is_default_branch}}

- name: Build and push Docker image

uses: docker/build-push-action@v5

with:

context: .

push: true

tags: ${{ steps.meta.outputs.tags }}

labels: ${{ steps.meta.outputs.labels }}

cache-from: type=gha

cache-to: type=gha,mode=max

- name: Save image name for later stages

run: |

echo "FULL_IMAGE_NAME=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-${{ github.sha }}" >> $GITHUB_ENV

echo "Image pushed: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}-${{ github.sha }}"

# Stage 7: Container Scanning

container-scan:

name: Container Scanning - Trivy

runs-on: ubuntu-latest

needs: docker-build

permissions:

contents: read

packages: read

security-events: write

steps:

- name: Log in to GitHub Container Registry

uses: docker/login-action@v3

with:

registry: ${{ env.REGISTRY }}

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

- name: Run Trivy vulnerability scanner

uses: aquasecurity/trivy-action@master

with:

image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}

format: 'sarif'

output: 'trivy-results.sarif'

severity: 'CRITICAL,HIGH,MEDIUM'

- name: Upload Trivy results to GitHub Security

uses: github/codeql-action/upload-sarif@v3

if: always()

with:

sarif_file: 'trivy-results.sarif'

- name: Run Trivy for JSON output

uses: aquasecurity/trivy-action@master

with:

image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}

format: 'json'

output: 'trivy-results.json'

- name: Run Trivy for HTML output

uses: aquasecurity/trivy-action@master

continue-on-error: true

with:

image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}

format: 'template'

template: '@$HOME/.local/bin/trivy-bin/contrib/html.tpl'

output: 'trivy-results.html'

- name: Upload Trivy results

if: always()

uses: actions/upload-artifact@v4

with:

name: trivy-results

path: |

trivy-results.json

trivy-results.html

# Stage 8: DAST - Dynamic Application Security Testing

dast-zap:

name: DAST - OWASP ZAP

runs-on: ubuntu-latest

needs: docker-build

permissions:

contents: read

packages: read

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Log in to GitHub Container Registry

uses: docker/login-action@v3

with:

registry: ${{ env.REGISTRY }}

username: ${{ github.actor }}

password: ${{ secrets.GITHUB_TOKEN }}

- name: Start application container

run: |

docker run -d --name solar-system-app \

-p 3000:3000 \

-e MONGO_URI="${{ secrets.MONGO_URI }}" \

${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}

# Wait for application to be ready

sleep 10

curl -f http://localhost:3000/ready || exit 1

- name: Run OWASP ZAP Baseline Scan

uses: zaproxy/[email protected]

with:

target: 'http://localhost:3000/'

cmd_options: '-a'

allow_issue_writing: false

artifact_name: '' # Disable ZAP's internal artifact upload (we handle it manually)

continue-on-error: true # Don't fail pipeline on warnings

- name: Upload ZAP scan results

if: always()

uses: actions/upload-artifact@v4

with:

name: zap-dast-results

path: |

report_json.json

report_md.md

report_html.html

- name: Stop application container

if: always()

run: docker stop solar-system-app && docker rm solar-system-app

# Stage 9: Deploy Infrastructure and Application to Azure

deploy-azure:

name: Deploy to Azure Web App

runs-on: ubuntu-latest

needs: [container-scan, dast-zap]

if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'

permissions:

contents: read

packages: read

environment:

name: production

url: https://${{ vars.AZURE_WEBAPP_NAME }}.azurewebsites.net

env:

WEBAPP_NAME: ${{ vars.AZURE_WEBAPP_NAME }}

ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}

ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}

ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}

ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}

steps:

- name: Checkout code

uses: actions/checkout@v4

- name: Log in to Azure

uses: azure/login@v1

with:

creds: ${{ secrets.AZURE_CREDENTIALS }}

- name: Setup Terraform

uses: hashicorp/setup-terraform@v3

with:

terraform_version: 1.6.0

- name: Terraform Init

run: terraform init

working-directory: ./terraform

- name: Terraform Plan

run: |

terraform plan \

-var="app_name=${{ vars.AZURE_WEBAPP_NAME }}" \

-var="github_username=${{ github.repository_owner }}" \

-var="github_token=${{ secrets.GITHUB_TOKEN }}" \

-var="mongo_uri=${{ secrets.MONGO_URI }}" \

-var="docker_image=${{ github.repository_owner }}/solar-system:${{ github.ref_name }}" \

-out=tfplan

working-directory: ./terraform

- name: Terraform Apply

run: terraform apply -auto-approve tfplan

working-directory: ./terraform

- name: Get Web App URL

id: webapp

run: |

WEBAPP_URL=$(terraform output -raw webapp_url)

echo "url=$WEBAPP_URL" >> $GITHUB_OUTPUT

working-directory: ./terraform

- name: Restart Web App (force pull latest image)

run: |

az webapp restart \

--name ${{ vars.AZURE_WEBAPP_NAME }} \

--resource-group $(terraform output -raw resource_group_name)

working-directory: ./terraform

- name: Health check

run: |

sleep 60

curl -f ${{ steps.webapp.outputs.url }}/ready || exit 1

echo "Application is healthy and running on Azure Web App!"