-
Notifications
You must be signed in to change notification settings - Fork 61
184 lines (163 loc) · 6.29 KB
/
veracode-3.0.x.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert
name: Veracode Maintenance 3.0.x
on:
schedule:
- cron: '30 14 * * *' # 14:30 UTC = 8:00 PM IST
env:
REFERENCE_BRANCH: maintenance-3.0.x
NPM_REPOSITORY: https://packages.nuxeo.com/repository/npm-public/
BRANCH_NAME: ${{ 'maintenance-3.0.x' }}
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
permissions:
contents: read
jobs:
# This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter
sast-scan-build:
# The type of runner that the job will run on
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: [self-hosted, master]
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps
- uses: actions/checkout@v2
with:
ref: ${{ env.BRANCH_NAME }}
- uses: actions/setup-node@v1
with:
registry-url: ${{ env.NPM_REPOSITORY }}
node-version: 18
scope: '@nuxeo'
- uses: actions/setup-java@v2
with:
distribution: 'zulu'
java-version: '11'
- name: Determine nuxeo-elements branch to link
id: pick_nuxeo_elements_branch
run: |
if git ls-remote --exit-code --heads https://github.com/nuxeo/nuxeo-elements ${{ env.BRANCH_NAME }}; then
echo ::set-output name=branch::${{ env.BRANCH_NAME }}
else
echo ::set-output name=branch::${{ env.REFERENCE_BRANCH }}
fi
- name: Install Web UI
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
run: |
npm install
pushd packages/nuxeo-web-ui-ftest
npm install
popd
- name: Checkout the nuxeo-elements repo
uses: actions/checkout@v2
with:
repository: nuxeo/nuxeo-elements
path: nuxeo-elements
fetch-depth: 1
ref: ${{ steps.pick_nuxeo_elements_branch.outputs.branch }}
- name: Pack Elements modules
run: |
pushd nuxeo-elements
pushd core
echo "ELEMENTS_CORE=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
popd
pushd ui
echo "ELEMENTS_UI=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
popd
pushd dataviz
echo "ELEMENTS_DATAVIZ=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
popd
pushd testing-helpers
echo "ELEMENTS_HELPERS=$(npm pack 2>&1 | tail -1)" >> $GITHUB_ENV
popd
popd
- name: add .npmrc
run: |
pushd /tmp/_temp/
rm .npmrc
touch .npmrc
popd
echo '
packages.nuxeo.com/repository/npm-public/:_auth=${NODE_AUTH_TOKEN}
@nuxeo:registry=https://packages.nuxeo.com/repository/npm-public/
always-auth=true
' >> /tmp/_temp/.npmrc
- name: Link elements to Web UI
run: |
npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/core/${ELEMENTS_CORE}
npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/ui/${ELEMENTS_UI}
npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/dataviz/${ELEMENTS_DATAVIZ}
npm install --no-package-lock --@nuxeo:registry="${{ env.NPM_REPOSITORY }}" nuxeo-elements/testing-helpers/${ELEMENTS_HELPERS}
- name: 'Update settings.xml with server configuration'
run: |
echo '<settings>
<servers>
<server>
<id>maven-internal</id>
<username>${{ secrets.PACKAGES_AUTH_USER }}</username>
<password>${{ secrets.PACKAGES_AUTH_TOKEN }}</password>
</server>
</servers>
</settings>' > ~/.m2/settings.xml
- name: Delete Node Modules
run: |
rm -rf node_modules
rm -rf packages/nuxeo-designer-catalog/node_modules
rm -rf packages/nuxeo-web-ui-ftest/node_modules
rm -rf plugin/a11y/node_modules
- name: Delete Test Folders
run: |
rm -rf nuxeo-elements/testing-helpers/
rm -rf nuxeo-elements/ui/test/
rm -rf nuxeo-elements/storybook/
rm -rf ftest/
rm -rf plugin/
rm -rf scripts/
rm -rf test/
rm -rf packages/nuxeo-web-ui-ftest/
- name: Install zip
run: apt-get install zip
- name: Zip nuxeo-web-ui
run: |
echo nuxeo-web-ui-${{ steps.get-tag.outputs.TAG }}.zip
zip -r nuxeo-web-ui.zip *
- name: Upload ZIP as artifact
uses: actions/upload-artifact@v3
with:
name: nuxeo-web-ui
path: nuxeo-web-ui.zip
sast-scan:
needs: sast-scan-build
permissions:
contents: read
security-events: write
actions: read
runs-on: ubuntu-latest
steps:
- name: Download artifact
uses: actions/download-artifact@v3
with:
name: nuxeo-web-ui
path: .
- name: List downloaded artifact
run: |
ls -l
pwd
- name: Veracode Upload And Scan
uses: veracode/veracode-uploadandscan-action@0.2.6
with:
appname: 'Nuxeo Web UI'
createprofile: false
filepath: 'nuxeo-web-ui.zip'
vid: '${{ secrets.VERACODE_SECRET_API_ID }}'
vkey: '${{ secrets.VERACODE_SECRET_KEY }}'
sandboxname: 'master'
scantimeout: 600
include: '*.war, *.zip, *.js, *.html, *.css, *.json'
criticality: 'High'
includenewmodules: 'true'