diff --git a/.github/workflows/README.md b/.github/workflows/README.md new file mode 100644 index 00000000..83c831f0 --- /dev/null +++ b/.github/workflows/README.md @@ -0,0 +1 @@ +# test diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml deleted file mode 100644 index e8e52f91..00000000 --- a/.github/workflows/code-quality.yml +++ /dev/null @@ -1,43 +0,0 @@ -# Goal - I have to do SAST for my Code - -name: Code Quality - -on: - workflow_call: # you can call this workflow before/after any other workflow - -jobs: - sast: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Setup NodeJs - uses: actions/setup-node@v6 - with: - node-version: '20' - cache: npm - cache-dependency-path: frontend/package-lock.json - - - name: Install npm Packages - run: npm install --legacy-peer-deps - working-directory: frontend - - - name: Run Linter - run: npm run lint - working-directory: frontend - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: '1.23' - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Run Go Formatter - run: go fmt - working-directory: backend - - - name: Run Go Vet - run: go vet - working-directory: backend \ No newline at end of file diff --git a/.github/workflows/code-tests.yml b/.github/workflows/code-tests.yml deleted file mode 100644 index bd297060..00000000 --- a/.github/workflows/code-tests.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Code Tests - -on: - workflow_call: - -jobs: - test: - # Github runner - runs-on: ubuntu-latest - steps: - - name: Checkout Code - uses: actions/checkout@v7 - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: '1.23' - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Setup NodeJs - uses: actions/setup-node@v6 - with: - node-version: '20' - cache: npm - cache-dependency-path: frontend/package.json - - - name: Install Dependencies - run: npm install --legacy-peer-deps - working-directory: frontend - - - name: Run Tests - run: npm run test - working-directory: frontend - - - name: Run Tests - run: go test - working-directory: backend \ No newline at end of file diff --git a/.github/workflows/dast.yml b/.github/workflows/dast.yml deleted file mode 100644 index c9755909..00000000 --- a/.github/workflows/dast.yml +++ /dev/null @@ -1,24 +0,0 @@ -# Goal - To ensure my running application is free from OWASP top 10 security issues -name: OWASP ZAP DAST Scan - -on: - workflow_call: - -jobs: - scan: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Wait for services to be healthy - run: | - timeout 60s sh -c 'until curl -s http://${{ secrets.EC2_HOST }}:8080 > /dev/null; do sleep 2; done' - - - name: OWASP ZAP Baseline Scan - uses: zaproxy/action-baseline@v0.14.0 - with: - token: ${{ secrets.GITHUB_TOKEN }} - target: 'http://${{ secrets.EC2_HOST }}:8080' - fail_action: false - allow_issue_writing: false \ No newline at end of file diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml deleted file mode 100644 index 578228e6..00000000 --- a/.github/workflows/dependency-scan.yml +++ /dev/null @@ -1,47 +0,0 @@ -# Goal - I have to ensure the packages & dependencies have been audited for Security - -name: Dependecy scan - -on: - workflow_call: - -jobs: - dependency-scan: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: 1.22 - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Install Govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 - - - name: GoVulncheck - continue-on-error: true - run: govulncheck ./... > govulncheck-report.txt - working-directory: backend - - - name: Setup Node - uses: actions/setup-node@v6 - with: - node-version: '20' - cache: npm - cache-dependency-path: frontend/package-lock.json - - - name: Run Dependency Scan for Node - run: npm audit - working-directory: frontend - - - name: Upload Report to Artifacts - if: always() # Ensures report uploads even if tests fail - uses: actions/upload-artifact@v4 - with: - name: dependency-scan-report - path: reports/dependency-report.txt - retention-days: 5 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml deleted file mode 100644 index 622de0b3..00000000 --- a/.github/workflows/deploy.yml +++ /dev/null @@ -1,28 +0,0 @@ -# Goal: To deploy the built images from CI Steps once the CI Worklow is Succeeded - -name: CD - -on: - workflow_call: - -jobs: - deploy: - - runs-on: self-hosted - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Copy Example Env to main env - run: cp .env.example .env - - - name: Docker Setup [Login] - uses: docker/login-action@v4 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Deploy the containers with Docker Compose - run: | - docker compose pull - docker compose up -d diff --git a/.github/workflows/devsecops.yml b/.github/workflows/devsecops.yml deleted file mode 100644 index 15c4a12d..00000000 --- a/.github/workflows/devsecops.yml +++ /dev/null @@ -1,53 +0,0 @@ -# Goal - To Run End to End DevSecOps CI Pipeline - -name: DevSecOps - -on: - push: - branches: [master] - -jobs: - - ## ---- CI ---- - # Code Stage - code-quality: - uses: ./.github/workflows/code-quality.yml - - # Secret Scanning - secret-scanning: - uses: ./.github/workflows/secret-scanning.yml - - # Dependency Checks - dependency-checks: - uses: ./.github/workflows/dependency-scan.yml - - # Docker Checks - docker-checks: - uses: ./.github/workflows/docker-scans.yml - secrets: inherit - - # SonarQube - sonar-qube: - uses: ./.github/workflows/sonar-scan.yml - secrets: inherit - - # Code Tests - code-tests: - uses: ./.github/workflows/code-tests.yml - - # push-to-docker-hub: - docker-push: - uses: ./.github/workflows/docker-push.yml - needs: [code-quality,code-tests,sonar-qube,docker-checks,dependency-checks,secret-scanning] - secrets: inherit - - ## ---- CD ----- - deploy: - needs: [docker-push] - uses: ./.github/workflows/deploy.yml - secrets: inherit - - dast-scan: - needs: [deploy] - uses: ./.github/workflows/dast.yml - secrets: inherit \ No newline at end of file diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml deleted file mode 100644 index c46f88fe..00000000 --- a/.github/workflows/docker-push.yml +++ /dev/null @@ -1,31 +0,0 @@ -# Goal Push the images to DockerHub -name: Docker Push - -on: - workflow_call: - -jobs: - frontend: - # Github runner - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - folders: ['backend','frontend'] - steps: - - name: Checkout Code - uses: actions/checkout@v7 - - - name: Docker Setup [Login] - uses: docker/login-action@v4 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Docker Build and Push - uses: docker/build-push-action@v7 - with: - context: ./${{ matrix.folders}} - push: true - tags: ${{ vars.DOCKERHUB_USERNAME }}/devboard-${{ matrix.folders}}:latest - \ No newline at end of file diff --git a/.github/workflows/docker-scans.yml b/.github/workflows/docker-scans.yml deleted file mode 100644 index 5ad07018..00000000 --- a/.github/workflows/docker-scans.yml +++ /dev/null @@ -1,44 +0,0 @@ -# Goal - Ensure the docker files and Docker images are security Tested - -name: Docker Scan - -on: - workflow_call: - -jobs: - docker-file-lint-and-scan: - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - folders: ['backend','frontend'] - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: ${{ matrix.folders}} Dockerfile Lint - uses: hadolint/hadolint-action@v3.1.0 - with: - dockerfile: ${{ matrix.folders}}/Dockerfile - - - name: Docker Setup [Login] - uses: docker/login-action@v4 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Docker Build ${{ matrix.folders}} - run: docker build -t ${{ vars.DOCKERHUB_USERNAME }}/devboard-${{ matrix.folders }}:latest . - working-directory: ${{ matrix.folders}} - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@v0.36.0 - continue-on-error: true - with: - image-ref: ${{ vars.DOCKERHUB_USERNAME }}/devboard-${{ matrix.folders }}:latest - format: 'table' - exit-code: '1' - ignore-unfixed: true - vuln-type: 'os,library' - severity: 'CRITICAL' - diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml deleted file mode 100644 index 84a161ca..00000000 --- a/.github/workflows/matrix.yml +++ /dev/null @@ -1,33 +0,0 @@ -# Goal To install multiple versions of Go and do linting for multiple versions -name: Go Linter - -on: - workflow_dispatch: - -jobs: - code-format: - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - go: ['1.22','1.23','1.24'] - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: ${{ matrix.go }} - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Run Go Formatter - run: go fmt - working-directory: backend - - - name: Run Go Vet - run: go vet - working-directory: backend - - \ No newline at end of file diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml new file mode 100644 index 00000000..ef12ea81 --- /dev/null +++ b/.github/workflows/pr-check.yml @@ -0,0 +1,14 @@ +name: PR Check + +on: + pull_request: + branches: [ci-triggers-matrix] + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Print PR branch + run: 'echo "PR check running for branch: ${{ github.head_ref }}"' + diff --git a/.github/workflows/secret-scanning.yml b/.github/workflows/secret-scanning.yml deleted file mode 100644 index 9a749796..00000000 --- a/.github/workflows/secret-scanning.yml +++ /dev/null @@ -1,20 +0,0 @@ -# Goal - To ensure no secrets have been leaked in the code - -name: Secrets Scanning - -on: - workflow_call: - -jobs: - scan-secrets: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - - name: GitLeaks Scanner - uses: gitleaks/gitleaks-action@v3 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml deleted file mode 100644 index e15dadf3..00000000 --- a/.github/workflows/sonar-scan.yml +++ /dev/null @@ -1,19 +0,0 @@ -# Goal - to check whether the application code coverage doesn't have security threats/issues - -name: Sonar Qube Scan - -on: - workflow_call: - -jobs: - sonar-scanner: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@v8.2.0 - env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} \ No newline at end of file