From 5c1c1280d7e425823a5908acccb210e583997fe4 Mon Sep 17 00:00:00 2001
From: rakeshkumar1019 <srakeshkumar1019@gmail.com>
Date: Wed, 11 Sep 2024 11:27:36 +0530
Subject: [PATCH] WEBUI-1572: schedule veracode scan

---
 .github/workflows/veracode-3.0.x.yaml         | 206 ++++++++++++++++++
 .../{veracode.yml => veracode-3.1.x.yaml}     | 155 +++++++------
 2 files changed, 290 insertions(+), 71 deletions(-)
 create mode 100644 .github/workflows/veracode-3.0.x.yaml
 rename .github/workflows/{veracode.yml => veracode-3.1.x.yaml} (60%)

diff --git a/.github/workflows/veracode-3.0.x.yaml b/.github/workflows/veracode-3.0.x.yaml
new file mode 100644
index 0000000000..0883f32852
--- /dev/null
+++ b/.github/workflows/veracode-3.0.x.yaml
@@ -0,0 +1,206 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert
+ 
+name: Veracode Maintenance 3.0.x
+
+on:
+  schedule:
+    - cron: '30 14 * * *'   # 14:30 UTC = 8:00 PM IST
+  workflow_call:
+    inputs:
+      branch:
+        description: 'The branch to Analyze'
+        type: string
+        required: true
+    secrets:
+      NPM_PACKAGES_TOKEN:
+        description: 'NPM_PACKAGES_TOKEN'
+        required: true
+      PACKAGES_AUTH_USER:
+        description: 'PACKAGES_AUTH_USER'
+        required: true
+      PACKAGES_AUTH_TOKEN:
+        description: 'PACKAGES_AUTH_TOKEN'
+        required: true
+      VERACODE_API_ID:
+        description: 'VERACODE_API_ID'
+        required: true
+      VERACODE_API_KEY:
+        description: 'VERACODE_API_KEY'
+        required: true
+
+env:
+  REFERENCE_BRANCH: maintenance-3.0.x
+  NPM_REPOSITORY: https://packages.nuxeo.com/repository/npm-public/
+  BRANCH_NAME: ${{ github.head_ref || inputs.branch || 'maintenance-3.0.x' }}
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: read
+
+jobs:
+  # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
+  sast-scan-build:
+    # The type of runner that the job will run on
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    runs-on: [self-hosted, master]
+    steps:
+
+    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
+    - uses: actions/checkout@v2
+      with:
+          ref: ${{ env.BRANCH_NAME }}
+
+    - uses: actions/setup-node@v1
+      with:
+          registry-url: ${{ env.NPM_REPOSITORY }}
+          node-version: 18
+          scope: '@nuxeo'
+
+    - uses: actions/setup-java@v2
+      with: 
+          distribution: 'zulu'
+          java-version: '11'
+
+    - name: Determine nuxeo-elements branch to link
+      id: pick_nuxeo_elements_branch
+      run: |
+          if git ls-remote --exit-code --heads https://github.com/nuxeo/nuxeo-elements ${{ env.BRANCH_NAME }}; then
+            echo ::set-output name=branch::${{ env.BRANCH_NAME }}
+          else
+            echo ::set-output name=branch::${{ env.REFERENCE_BRANCH }}
+          fi
+    - name: Install Web UI
+      env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
+      run: |
+          npm install
+          pushd packages/nuxeo-web-ui-ftest
+          npm install
+          popd
+    - name: Checkout the nuxeo-elements repo
+      uses: actions/checkout@v2
+      with:
+          repository: nuxeo/nuxeo-elements
+          path: nuxeo-elements
+          fetch-depth: 1
+          ref: ${{ steps.pick_nuxeo_elements_branch.outputs.branch }}
+
+    - name: Pack Elements modules
+      run: |
+          pushd nuxeo-elements
+          pushd core
+          echo "ELEMENTS_CORE=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
+          popd
+          pushd ui
+          echo "ELEMENTS_UI=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
+          popd
+          pushd dataviz
+          echo "ELEMENTS_DATAVIZ=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
+          popd
+          pushd testing-helpers
+          echo "ELEMENTS_HELPERS=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
+          popd
+          popd
+
+    - name: add .npmrc
+      run: |
+        pushd /tmp/_temp/
+        rm .npmrc
+        touch .npmrc
+        popd
+        echo '
+          packages.nuxeo.com/repository/npm-public/:_auth=${NODE_AUTH_TOKEN}
+          @nuxeo:registry=https://packages.nuxeo.com/repository/npm-public/
+          always-auth=true
+        ' >> /tmp/_temp/.npmrc
+
+    - name: Link elements to Web UI
+      run: |
+          npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/core/${ELEMENTS_CORE}
+          npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/ui/${ELEMENTS_UI}
+          npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/dataviz/${ELEMENTS_DATAVIZ}
+          npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/testing-helpers/${ELEMENTS_HELPERS}
+    - name: 'Update settings.xml with server configuration'
+      run: |
+          echo '<settings>
+              <servers>
+                <server>
+                  <id>maven-internal</id>
+                  <username>${{ secrets.PACKAGES_AUTH_USER }}</username>
+                  <password>${{ secrets.PACKAGES_AUTH_TOKEN }}</password>
+                </server>
+              </servers>
+              </settings>' > ~/.m2/settings.xml
+
+    - name: Delete Node Modules
+      run: |
+        rm -rf node_modules
+        rm -rf packages/nuxeo-designer-catalog/node_modules
+        rm -rf packages/nuxeo-web-ui-ftest/node_modules
+        rm -rf plugin/a11y/node_modules 
+       
+    - name: Delete Test Folders
+      run: |
+        rm -rf nuxeo-elements/testing-helpers/
+        rm -rf nuxeo-elements/ui/test/
+        rm -rf nuxeo-elements/storybook/
+        rm -rf ftest/
+        rm -rf plugin/
+        rm -rf scripts/
+        rm -rf test/
+        rm -rf packages/nuxeo-web-ui-ftest/
+
+    - name: Install zip
+      run: apt-get install zip
+
+    - name: Zip nuxeo-web-ui
+      run: |
+        echo nuxeo-web-ui-${{ steps.get-tag.outputs.TAG }}.zip
+        zip -r nuxeo-web-ui.zip *
+
+    - name: Upload ZIP as artifact
+      uses: actions/upload-artifact@v2
+      with:
+        name: nuxeo-web-ui
+        path: nuxeo-web-ui.zip
+  
+  sast-scan:
+    needs: sast-scan-build
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v2
+        with:
+          name: nuxeo-web-ui
+          path: .
+
+      - name: List downloaded artifact
+        run: |
+          ls -l
+          pwd
+
+      - name: Veracode Upload And Scan
+        uses: veracode/veracode-uploadandscan-action@0.2.6
+        with:
+          appname: 'Nuxeo Web UI'
+          createprofile: false
+          filepath: 'nuxeo-web-ui.zip'
+          vid: '${{ secrets.VERACODE_SECRET_API_ID }}'
+          vkey: '${{ secrets.VERACODE_SECRET_KEY }}'
+          sandboxname: 'master'
+          scantimeout: 600
+          include: '*.war, *.zip, *.js, *.html, *.css, *.json'
+          criticality: 'High'
+          includenewmodules: 'true'
\ No newline at end of file
diff --git a/.github/workflows/veracode.yml b/.github/workflows/veracode-3.1.x.yaml
similarity index 60%
rename from .github/workflows/veracode.yml
rename to .github/workflows/veracode-3.1.x.yaml
index b53ca0efbe..85d44e385c 100644
--- a/.github/workflows/veracode.yml
+++ b/.github/workflows/veracode-3.1.x.yaml
@@ -4,16 +4,12 @@
 # documentation.
 
 # This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert
-
-name: Veracode
+ 
+name: Veracode Maintenance 3.1.x
 
 on:
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "maintenance-3.1.x" ]
   schedule:
-    # At 01:00 on Sunday
-    - cron: '0 1 * * SUN'
+    - cron: '30 15 * * *'  # 15:30 UTC = 9:00 PM IST
   workflow_call:
     inputs:
       branch:
@@ -48,13 +44,13 @@ permissions:
 
 jobs:
   # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
-  sast-scan:
+  sast-scan-build:
     # The type of runner that the job will run on
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
       actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, master]
     steps:
 
     # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
@@ -65,13 +61,13 @@ jobs:
     - uses: actions/setup-node@v1
       with:
           registry-url: ${{ env.NPM_REPOSITORY }}
-          node-version: 14
+          node-version: 18
           scope: '@nuxeo'
 
     - uses: actions/setup-java@v2
       with: 
           distribution: 'zulu'
-          java-version: '17'
+          java-version: '11'
 
     - name: Determine nuxeo-elements branch to link
       id: pick_nuxeo_elements_branch
@@ -113,6 +109,19 @@ jobs:
           echo "ELEMENTS_HELPERS=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
           popd
           popd
+
+    - name: add .npmrc
+      run: |
+        pushd /tmp/_temp/
+        rm .npmrc
+        touch .npmrc
+        popd
+        echo '
+          packages.nuxeo.com/repository/npm-public/:_auth=${NODE_AUTH_TOKEN}
+          @nuxeo:registry=https://packages.nuxeo.com/repository/npm-public/
+          always-auth=true
+        ' >> /tmp/_temp/.npmrc
+
     - name: Link elements to Web UI
       run: |
           npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/core/${ELEMENTS_CORE}
@@ -130,64 +139,68 @@ jobs:
                 </server>
               </servers>
               </settings>' > ~/.m2/settings.xml
-    - name: Nuxeo package build
-      run: mvn install -DskipInstall
-    - name: Archive packages
-      uses: actions/upload-artifact@v3
-      with:
-        name: packages
-        path: |
-          plugin/web-ui/marketplace/target/nuxeo-web-ui-marketplace-*.zip
-
-    # download the Veracode Static Analysis Pipeline scan jar
-    - run: curl --silent --show-error --fail -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
-    - run: unzip -o pipeline-scan-LATEST.zip   
-    - name: Code Scanning
-      id: code_scanning
-      run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --summary_output=true --file plugin/web-ui/marketplace/target/nuxeo-web-ui-marketplace-*.zip
-      continue-on-error: true
-    - name: Convert pipeline scan output to SARIF format
-      id: convert
-      uses: Veracode/veracode-pipeline-scan-results-to-sarif@v1.0.5
-      with:
-        pipeline-results-json: results.json
-        output-results-sarif: veracode-results.sarif
-        finding-rule-level: "4:3:0"
-    - name: Upload SARIF file to repository
-      uses: github/codeql-action/upload-sarif@v2
-      with:
-        # Path to SARIF file relative to the root of the repository
-        sarif_file: veracode-results.sarif
-    - name: Slack notification
-      if: (github.event_name == 'pull_request' || github.event_name == 'schedule')
-      uses: slackapi/slack-github-action@v1.23.0
-      env:
-        REPO_URL: ${{ github.server_url }}/${{ github.repository }}
-        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}
-      with:
-        channel-id: ${{ env.SLACK_CHANNEL_ID }}
-        payload: |
-          {
-            "text": "<${{ env.REPO_URL }}/actions/runs/${{ github.run_id }}|Code scanning> ${{ steps.code_scanning.outcome }} in nuxeo/nuxeo-web-ui <${{ env.REPO_URL }}/commit/${{ github.sha }}|${{ github.ref_name }}>",
-            "blocks": [
-              {
-                "type": "section",
-                "text": {
-                   "type": "mrkdwn",
-                   "text": "<${{ env.REPO_URL }}/actions/runs/${{ github.run_id }}|Code scanning> ${{ job.status }} in nuxeo/nuxeo-WEB-UI <${{ env.REPO_URL }}/commit/${{ github.sha }}|${{ github.ref_name }}>"
-                 }
-              }
-            ]
-          }
-    - name: Send scan result summary to slack
-      uses: crederauk/slack-workflow-summary@v1.2.2
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
-    - name: Send scan result file to slack
-      uses: adrey/slack-file-upload-action@master
+
+    - name: Delete Node Modules
+      run: |
+        rm -rf node_modules
+        rm -rf packages/nuxeo-designer-catalog/node_modules
+        rm -rf packages/nuxeo-web-ui-ftest/node_modules
+        rm -rf plugin/a11y/node_modules 
+       
+    - name: Delete Test Folders
+      run: |
+        rm -rf nuxeo-elements/testing-helpers/
+        rm -rf nuxeo-elements/ui/test/
+        rm -rf nuxeo-elements/storybook/
+        rm -rf ftest/
+        rm -rf plugin/
+        rm -rf scripts/
+        rm -rf test/
+        rm -rf packages/nuxeo-web-ui-ftest/
+
+    - name: Install zip
+      run: apt-get install zip
+
+    - name: Zip nuxeo-web-ui
+      run: |
+        echo nuxeo-web-ui-${{ steps.get-tag.outputs.TAG }}.zip
+        zip -r nuxeo-web-ui.zip *
+
+    - name: Upload ZIP as artifact
+      uses: actions/upload-artifact@v2
       with:
-        token: ${{ secrets.SLACK_BOT_TOKEN }}
-        path: results.txt
-        channel: ${{ secrets.SLACK_CHANNEL_ID }}
\ No newline at end of file
+        name: nuxeo-web-ui
+        path: nuxeo-web-ui.zip
+  
+  sast-scan:
+    needs: sast-scan-build
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v2
+        with:
+          name: nuxeo-web-ui
+          path: .
+
+      - name: List downloaded artifact
+        run: |
+          ls -l
+          pwd
+
+      - name: Veracode Upload And Scan
+        uses: veracode/veracode-uploadandscan-action@0.2.6
+        with:
+          appname: 'Nuxeo Web UI'
+          createprofile: false
+          filepath: 'nuxeo-web-ui.zip'
+          vid: '${{ secrets.VERACODE_SECRET_API_ID }}'
+          vkey: '${{ secrets.VERACODE_SECRET_KEY }}'
+          sandboxname: 'master'
+          scantimeout: 600
+          include: '*.war, *.zip, *.js, *.html, *.css, *.json'
+          criticality: 'High'
+          includenewmodules: 'true'
\ No newline at end of file