Skip to content

Commit 8078f65

Browse files
Akash29gAkash29g
authored
Merge pull request #64 from Akash29g/ci/round-2-devsecops-scans
R2 CI: Add DevSecOps gates (gitleaks + dependency vuln checks + Trivy) + Dependabot
2 parents 28c086c + 4ce8970 commit 8078f65

6 files changed

Lines changed: 198 additions & 7 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: 2
2+
updates:
3+
# ---- Backend: NuGet (.NET) ----
4+
- package-ecosystem: "nuget"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
open-pull-requests-limit: 10
9+
10+
# ---- Frontend: npm (Angular app) ----
11+
- package-ecosystem: "npm"
12+
directory: "/docanalytics-web"
13+
schedule:
14+
interval: "weekly"
15+
open-pull-requests-limit: 10

‎.github/workflows/ci.yml‎

Lines changed: 75 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
1+
# workflow bump: force refresh after removing setup-trivy
12
name: CI
23

3-
# Runs on every PR (any target branch) + pushes to main.
44
on:
55
pull_request:
66
push:
77
branches: [main]
88

9-
# Least-privilege token (status checks only need read).
109
permissions:
1110
contents: read
1211

13-
# Fail-fast: cancel a superseded run when new commits land on the same ref.
1412
concurrency:
1513
group: ci-${{ github.workflow }}-${{ github.ref }}
1614
cancel-in-progress: true
@@ -35,9 +33,6 @@ jobs:
3533
- name: Build
3634
run: dotnet build DocAnalytics.slnx --no-restore --configuration Release
3735

38-
# Fast gate = 4 correctness projects (Round 0 decision).
39-
# Performance.Tests is intentionally EXCLUDED from the blocking gate.
40-
# bash runs with -eo pipefail, so the first failing project stops the job (fail-fast).
4136
- name: Test (correctness projects)
4237
run: |
4338
dotnet test DocAnalytics.Domain.Tests/DocAnalytics.Domain.Tests.csproj --no-build --configuration Release
@@ -46,7 +41,6 @@ jobs:
4641
dotnet test DocAnalytics.Api.Tests/DocAnalytics.Api.Tests.csproj --no-build --configuration Release
4742
4843
# ──────────────────────── Frontend (Angular 22) ────────────────────────
49-
# Runs in PARALLEL with `backend` (no `needs:` dependency between them).
5044
frontend:
5145
name: frontend (build + test)
5246
runs-on: ubuntu-latest
@@ -72,3 +66,77 @@ jobs:
7266

7367
- name: Test (Vitest, single run)
7468
run: npx ng test --watch=false
69+
70+
# ──────────────────────── DevSecOps (scans) ────────────────────────
71+
devsecops:
72+
name: devsecops (secrets + deps + image scan)
73+
runs-on: ubuntu-latest
74+
permissions:
75+
contents: read
76+
steps:
77+
- name: Checkout
78+
uses: actions/checkout@v4
79+
80+
- name: Gitleaks (working tree only, via Docker)
81+
run: |
82+
docker run --rm \
83+
-v "${{ github.workspace }}:/repo" \
84+
ghcr.io/gitleaks/gitleaks:v8.24.3 \
85+
detect \
86+
--source=/repo \
87+
--no-git \
88+
--redact \
89+
--config=/repo/.gitleaks.toml \
90+
--exit-code 1
91+
92+
93+
# Backend dependency scan (.NET)
94+
- name: Setup .NET
95+
uses: actions/setup-dotnet@v4
96+
with:
97+
dotnet-version: '10.0.x'
98+
99+
- name: dotnet list package --vulnerable (fail on any)
100+
shell: bash
101+
run: |
102+
set -euo pipefail
103+
dotnet list DocAnalytics.slnx package --vulnerable --include-transitive | tee dotnet-vuln.txt
104+
if grep -qi "has the following vulnerable packages" dotnet-vuln.txt; then
105+
echo "❌ Vulnerable NuGet packages detected"
106+
exit 1
107+
fi
108+
109+
# Frontend dependency scan (npm)
110+
- name: Setup Node 22
111+
uses: actions/setup-node@v4
112+
with:
113+
node-version: '22'
114+
115+
- name: npm audit (HIGH+)
116+
working-directory: docanalytics-web
117+
run: |
118+
npm ci
119+
npm audit --audit-level=high
120+
121+
# Container image scan (Trivy) — run via Docker (no setup-trivy dependency)
122+
- name: Build API image
123+
run: docker build -t docanalytics-api:${{ github.sha }} -f DocAnalytics.Api/Dockerfile .
124+
125+
- name: Trivy scan (API image)
126+
run: |
127+
docker run --rm \
128+
-v /var/run/docker.sock:/var/run/docker.sock \
129+
aquasec/trivy:0.54.1 \
130+
image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 \
131+
docanalytics-api:${{ github.sha }}
132+
133+
- name: Build Web image
134+
run: docker build -t docanalytics-web:${{ github.sha }} -f docanalytics-web/Dockerfile docanalytics-web
135+
136+
- name: Trivy scan (Web image)
137+
run: |
138+
docker run --rm \
139+
-v /var/run/docker.sock:/var/run/docker.sock \
140+
aquasec/trivy:0.54.1 \
141+
image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 \
142+
docanalytics-web:${{ github.sha }}

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33
##
44
## Get latest from `dotnet new gitignore`
55

6+
# local gitleaks scan export
7+
.gitleaks-scan/
8+
repo-scan.tar
9+
610
# dotenv files
711
.env
812

‎DocAnalytics.Api/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ RUN dotnet publish DocAnalytics.Api/DocAnalytics.Api.csproj -c Release -o /app -
1818

1919
# ---- runtime stage ----
2020
FROM mcr.microsoft.com/dotnet/aspnet:10.0
21+
RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
2122
WORKDIR /app
2223
COPY --from=build /app .
2324
EXPOSE 8080

‎docanalytics-web/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ RUN npm run build
88

99
# ---- serve stage ----
1010
FROM nginx:alpine
11+
RUN apk update && apk upgrade --no-cache
1112
COPY nginx.conf /etc/nginx/conf.d/default.conf
1213
COPY --from=build /app/dist/docanalytics-web/browser /usr/share/nginx/html
1314
EXPOSE 80

‎gitleaks-report.json‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
[
2+
{
3+
"RuleID": "aws-access-token",
4+
"Description": "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.",
5+
"StartLine": 9,
6+
"EndLine": 9,
7+
"StartColumn": 20,
8+
"EndColumn": 39,
9+
"Match": "REDACTED",
10+
"Secret": "REDACTED",
11+
"File": ".env",
12+
"SymlinkFile": "",
13+
"Commit": "",
14+
"Entropy": 3.8841836,
15+
"Author": "",
16+
"Email": "",
17+
"Date": "",
18+
"Message": "",
19+
"Tags": [],
20+
"Fingerprint": ".env:aws-access-token:9"
21+
},
22+
{
23+
"RuleID": "generic-api-key",
24+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
25+
"StartLine": 1,
26+
"EndLine": 1,
27+
"StartColumn": 122,
28+
"EndColumn": 146,
29+
"Match": "Password=REDACTED;",
30+
"Secret": "REDACTED",
31+
"File": ".env",
32+
"SymlinkFile": "",
33+
"Commit": "",
34+
"Entropy": 3.640224,
35+
"Author": "",
36+
"Email": "",
37+
"Date": "",
38+
"Message": "",
39+
"Tags": [],
40+
"Fingerprint": ".env:generic-api-key:1"
41+
},
42+
{
43+
"RuleID": "generic-api-key",
44+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
45+
"StartLine": 10,
46+
"EndLine": 10,
47+
"StartColumn": 2,
48+
"EndColumn": 64,
49+
"Match": "AWS_SECRET_ACCESS_KEY=REDACTED\r",
50+
"Secret": "REDACTED",
51+
"File": ".env",
52+
"SymlinkFile": "",
53+
"Commit": "",
54+
"Entropy": 4.921928,
55+
"Author": "",
56+
"Email": "",
57+
"Date": "",
58+
"Message": "",
59+
"Tags": [],
60+
"Fingerprint": ".env:generic-api-key:10"
61+
},
62+
{
63+
"RuleID": "generic-api-key",
64+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
65+
"StartLine": 126,
66+
"EndLine": 126,
67+
"StartColumn": 267,
68+
"EndColumn": 639,
69+
"Match": "sessionKey=\"REDACTED\"",
70+
"Secret": "REDACTED",
71+
"File": ".vs/DocAnalytics.slnx/config/applicationhost.config",
72+
"SymlinkFile": "",
73+
"Commit": "",
74+
"Entropy": 5.8514104,
75+
"Author": "",
76+
"Email": "",
77+
"Date": "",
78+
"Message": "",
79+
"Tags": [],
80+
"Fingerprint": ".vs/DocAnalytics.slnx/config/applicationhost.config:generic-api-key:126"
81+
},
82+
{
83+
"RuleID": "generic-api-key",
84+
"Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
85+
"StartLine": 127,
86+
"EndLine": 127,
87+
"StartColumn": 267,
88+
"EndColumn": 639,
89+
"Match": "sessionKey=\"REDACTED\"",
90+
"Secret": "REDACTED",
91+
"File": ".vs/DocAnalytics.slnx/config/applicationhost.config",
92+
"SymlinkFile": "",
93+
"Commit": "",
94+
"Entropy": 5.8742857,
95+
"Author": "",
96+
"Email": "",
97+
"Date": "",
98+
"Message": "",
99+
"Tags": [],
100+
"Fingerprint": ".vs/DocAnalytics.slnx/config/applicationhost.config:generic-api-key:127"
101+
}
102+
]

0 commit comments

Comments
 (0)