Merge pull request #1192 from opensrp/security-ci-scan

Scanning CI

.github/codeql/codeql-config.yml

@@ -0,0 +1,13 @@
+name: My CodeQL Analysis
+description: A sample CodeQL analysis
+
+paths:
+  - src
+# Ignore the "docs" and "src/test" directories
+paths-ignore:
+  - 'docs/**'
+  - 'src/test/**'
+
+# # Specify the CodeQL queries to run
+# queries:
+#   - my-query.ql

.github/dependabot.yml

@@ -0,0 +1,47 @@
+version: 2
+updates:
+  # Keep maven dependencies up-to-date
+  - package-ecosystem: maven
+    # Look for `pom.xml`  in the `root` directory
+    directory: "/"
+    # Check the maven registry for updates every day (weekdays)
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    target-branch: 
+      - "master"
+      - "v2"
+    # Raise all maven pull requests with custom labels
+    labels:
+      - "maven dependencies"
+    commit-message:
+      prefix: requirements
+    reviewers:
+      - "hilpitome"
+      - "ekigamba"
+
+
+  # Keep docker dependencies up-to-date
+  - package-ecosystem: docker
+    # Look for `Dockerfile`  in the `root` directory
+    directory: "/"
+    # Check the docker registry for updates every day (weekdays)
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    target-branch: 
+      - "master"
+      - "v2"
+    # Raise all docker pull requests with custom labels
+    labels:
+      - "docker dependencies"
+    commit-message:
+      prefix: requirements
+    reviewers:
+      - "ukanga"
+      - "bennsimon"
+      - "qiarie"
+      - "manutarus"
+      - "hilpitome"
+      - "ekigamba"
+      - "ndegwamartin"

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,109 @@
+
+name: "CodeQL Repository scan"
+
+on:
+  push:
+    branches:
+      # - master
+      # - v2*
+      - security-ci-scan
+
+    # Publish `v1.2.3` tags as releases.
+    tags:
+      - v*
+  pull_request:
+  schedule:
+    - cron: '0 3 * * 1,3'     # CodeQL Scan every Monday and Wednesday at 3 AM UTC
+  # wokflow_dispatch option enables for manual scanning
+  workflow_dispatch:
+
+
+jobs:
+  analyze:
+    name: Analyze 
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'java' ]
+
+
+    steps:
+    - name: Cancel previous workflow runs
+      uses: styfle/[email protected]
+      with:
+        access_token: ${{ github.token }} 
+
+    - name: Checkout repository
+      uses: actions/checkout@v3
+      with:
+       submodules: recursive
+
+    - name: Set up JDK 11
+      uses: actions/setup-java@v1
+      with:
+        java-version: 11
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-and-quality
+        config-file: './.github/codeql/codeql-config.yml'
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    - name: Autobuild Java Code
+      run:  |
+        mvn clean install -DskipTests
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+    #   If the Autobuild fails above, remove it and uncomment the following three lines. 
+    #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+    # - run: |
+    #   echo "Run, Build Application using script"
+    #   ./location_of_script_within_repo/buildscript.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2
+      id: run-analysis
+      with:
+        category: "/language:${{matrix.language}}"        
+        output: 'results'
+
+    - name: Upload CodeQL results as an artifact
+      uses: actions/upload-artifact@v3
+      with:
+        # Path to SARIF file relative to the root of the repository
+        name: "java.sarif"
+        path: './results/java.sarif'
+
+    - name: Import CodeQL Findings to DefectDojo
+      uses: portswigger-cloud/defectdojo-import-scan@v1
+      with:
+        defectdojo-url: ${{ secrets.DEFECTOJO_URL }}
+        defectdojo-username: ${{ secrets.DEFECTOJO_USERNAME }}
+        defectdojo-password: ${{ secrets.DEFECTOJO_PASSWORD }}
+        defectdojo-product-type: OPENSRP
+        defectdojo-product: OpenSRP-Server-Web
+        defectdojo-environment-type: Test
+        defectdojo-scan-type: SARIF
+        defectdojo-engagement-name: Github Actions Initiated CodeQL Code Scan
+        scan-results-file-name: './results/java.sarif'
+
+

.github/workflows/docker-publish.yml

@@ -7,7 +7,9 @@ on:
     paths-ignore:
       - 'docs/**'
     branches:
-      - master
+      # - master 
+      # - v2*
+      - security-ci-scan    #To be deleted
 
     # Publish `v1.2.3` tags as releases.
     tags:
@@ -24,6 +26,11 @@ on:
         description: "Includes the specified tag to docker image tags"
         required: false
 
+# For Trivy Code Scanning
+env:
+  FULL_SUMMARY: ""
+  PATCH_SUMMARY: ""
+
 jobs:
   # Run image build test
   test:
@@ -103,3 +110,105 @@ jobs:
 
       - name: Image digest
         run: echo ${{ steps.docker_build.outputs.digest }}
+
+      - name: Run Trivy vulnerability scanner on Docker image - JSON (Full Scan)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
+          format: json
+          output: 'trivy-docker-full-results.json'
+
+      - name: Create summary of trivy issues on Docker image
+        run: |
+          summary=$(jq -r '.Results[] | select(.Vulnerabilities) | .Vulnerabilities | group_by(.Severity) | map({Severity: .[0].Severity, Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-docker-full-results.json | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
+          if [ -z $summary ]
+          then
+            summary="No vulnerabilities found"
+          fi
+          echo "FULL_SUMMARY=$summary" >> $GITHUB_ENV
+
+      - name: Run Trivy vulnerability scanner on Docker image - JSON (with Patches)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
+          ignore-unfixed: true
+          format: 'json'
+          output: 'trivy-docker-fixable-results.json'
+
+      - name: Create summary of trivy issues on Docker image
+        run: |
+          summary=$(jq -r '.Results[] | select(.Vulnerabilities) | .Vulnerabilities | group_by(.Severity) | map({Severity: .[0].Severity, Count: length}) | .[] | [.Severity, .Count] | join(": ")' trivy-docker-fixable-results.json | awk 'NR > 1 { printf(" | ") } {printf "%s",$0}')
+          if [ -z $summary ]
+          then
+            summary="No issues or vulnerability fixes available"
+          fi
+          echo "PATCH_SUMMARY=$summary" >> $GITHUB_ENV
+
+      - name: Run Trivy vulnerability scanner on Docker image - SARIF
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
+          format: sarif
+          ignore-unfixed: true
+          output: 'trivy-docker-results.sarif'          
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-docker-results.sarif'
+
+      - name: Generate trivy HTML report on Docker image for download
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ steps.docker_meta.outputs.tags }}
+          format: 'template'
+          template: '@/contrib/html.tpl'
+          output: 'trivy-docker-report.html'
+
+      - name: Upload Trivy results as an artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: "trivy-results-opensrp-server-web-docker-report.html"
+          path: './trivy-docker-report.html'
+          retention-days: 30
+
+      - name: Send Slack Notification
+        uses: slackapi/[email protected]
+        with:
+          payload: |
+            {
+              "text": "Trivy scan results for ${{ github.repository }} repository",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "TRIVY DOCKER SCAN RESULTS FOR ${{ github.repository }} REPOSITORY"
+                  }
+                },
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "   Total Vulnerabilities: ${{ env.FULL_SUMMARY }}"
+                  }
+                },
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "   Vulnerabilities with fixes: ${{ env.PATCH_SUMMARY }}"
+                  }
+                },
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "   View HTML result artifact: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}. Artifact is only valid for 30 days."
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK