Skip to content

Commit 29d30db

Browse files
developerkunaldeveloperkunal
committed
Added RL Scanner Workflow
1 parent 663450b commit 29d30db

File tree

8 files changed

+157
-40
lines changed

8 files changed

+157
-40
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
* @auth0/dx-sdks-engineer
1+
* @auth0/project-dx-sdks-engineer-codeowner

‎.github/actions/rl-scanner/action.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: 'Reversing Labs Scanner'
2+
description: 'Runs the Reversing Labs scanner on a specified artifact.'
3+
inputs:
4+
artifact-path:
5+
description: 'Path to the artifact to be scanned.'
6+
required: true
7+
version:
8+
description: 'Version of the artifact.'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: '3.10'
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: 'The outcome of the scan process.'
71+
value: ${{ env.scan-status }}

‎.github/workflows/browserstack.yml‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Browserstack
33
on:
44
merge_group:
55
workflow_dispatch:
6-
pull_request_target:
6+
pull_request:
77
types:
88
- opened
99
- synchronize
@@ -22,15 +22,8 @@ env:
2222
NODE_VERSION: 18
2323

2424
jobs:
25-
authorize:
26-
name: Authorize
27-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
28-
runs-on: ubuntu-latest
29-
steps:
30-
- run: true
3125

3226
browserstack:
33-
needs: authorize # Require approval before running on forked pull requests
3427

3528
name: BrowserStack Tests
3629
runs-on: ubuntu-latest

‎.github/workflows/integration.yml‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Integration Tests
33
on:
44
merge_group:
55
workflow_dispatch:
6-
pull_request_target:
6+
pull_request:
77
types:
88
- opened
99
- synchronize
@@ -22,16 +22,7 @@ env:
2222
NODE_VERSION: 18
2323

2424
jobs:
25-
26-
authorize:
27-
name: Authorize
28-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
29-
runs-on: ubuntu-latest
30-
steps:
31-
- run: true
32-
3325
test-examples:
34-
needs: authorize # Require approval before running on forked pull requests
3526
name: Run example tests
3627
runs-on: ubuntu-latest
3728

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ on:
55
types:
66
- closed
77
workflow_dispatch:
8-
98
permissions:
109
contents: write
1110
id-token: write # For publishing to npm using --provenance
@@ -15,11 +14,24 @@ permissions:
1514
### TODO: Also remove `npm-release` workflow from this repo's .github/workflows folder once the repo is public.
1615

1716
jobs:
17+
rl-scanner:
18+
uses: ./.github/workflows/rl-secure.yml
19+
with:
20+
node-version: 18
21+
artifact-name: 'auth0-java.tgz'
22+
secrets:
23+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
24+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
25+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
26+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
27+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
28+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
1829
release:
1930
uses: ./.github/workflows/npm-release.yml
31+
needs: rl-scanner
2032
with:
2133
node-version: 18
2234
require-build: true
2335
secrets:
2436
npm-token: ${{ secrets.NPM_TOKEN }}
25-
github-token: ${{ secrets.GITHUB_TOKEN }}
37+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/rl-secure.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: RL-Secure Workflow
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
node-version:
7+
required: true
8+
type: string
9+
artifact-name:
10+
required: true
11+
type: string
12+
secrets:
13+
RLSECURE_LICENSE:
14+
required: true
15+
RLSECURE_SITE_KEY:
16+
required: true
17+
SIGNAL_HANDLER_TOKEN:
18+
required: true
19+
PRODSEC_TOOLS_USER:
20+
required: true
21+
PRODSEC_TOOLS_TOKEN:
22+
required: true
23+
PRODSEC_TOOLS_ARN:
24+
required: true
25+
26+
jobs:
27+
rl-scanner:
28+
name: Run Reversing Labs Scanner
29+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
30+
runs-on: ubuntu-latest
31+
outputs:
32+
scan-status: ${{ steps.rl-scan-conclusion.outcome }}
33+
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 0
39+
40+
- name: Build package
41+
uses: ./.github/actions/build
42+
with:
43+
node: ${{ inputs.node-version }}
44+
45+
- name: Create tgz build artifact
46+
run: |
47+
tar -czvf ${{ inputs.artifact-name }} *
48+
49+
- id: get_version
50+
uses: ./.github/actions/get-version
51+
52+
- name: Run RL Scanner
53+
id: rl-scan-conclusion
54+
uses: ./.github/actions/rl-scanner
55+
with:
56+
artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
57+
version: "${{ steps.get_version.outputs.version }}"
58+
env:
59+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
60+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
61+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
62+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
63+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
64+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
65+
66+
- name: Output scan result
67+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

‎.github/workflows/semgrep.yml‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Semgrep
22

33
on:
44
merge_group:
5-
pull_request_target:
5+
pull_request:
66
types:
77
- opened
88
- synchronize
@@ -21,16 +21,7 @@ concurrency:
2121
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
2222

2323
jobs:
24-
authorize:
25-
name: Authorize
26-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
27-
runs-on: ubuntu-latest
28-
steps:
29-
- run: true
30-
3124
run:
32-
needs: authorize # Require approval before running on forked pull requests
33-
3425
name: Check for Vulnerabilities
3526
runs-on: ubuntu-latest
3627

‎.github/workflows/snyk.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: Snyk
33
on:
44
merge_group:
55
workflow_dispatch:
6-
pull_request_target:
6+
pull_request:
77
types:
88
- opened
99
- synchronize
@@ -22,15 +22,7 @@ concurrency:
2222
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
2323

2424
jobs:
25-
authorize:
26-
name: Authorize
27-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
28-
runs-on: ubuntu-latest
29-
steps:
30-
- run: true
31-
3225
check:
33-
needs: authorize
3426

3527
name: Check for Vulnerabilities
3628
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)