Skip to content

Latest commit

 

History

History
93 lines (53 loc) · 6.14 KB

README.md

File metadata and controls

93 lines (53 loc) · 6.14 KB

Vulnerability Scanning with DevGuard GitHub Actions Workflow

This GitHub Actions workflow allows you to integrate vulnerability management into your CI/CD pipeline using DevGuard. It simplifies the process of performing security scans, including Software Composition Analysis (SCA) and Container Scanning, ensuring that vulnerabilities are identified and mitigated early in your development process.

You can see how DevGuard works in practice here, where this repository is scanned using the same components.

Read more about DevGuard and its features here.

Workflows Overview

The DevGuard workflow automates the process of ensuring security, quality, and efficiency throughout the development and deployment pipeline. It integrates various security and build-related tasks to enhance the integrity of your code and container images before deployment. Below is a breakdown of the individual jobs included in the workflow:

Jobs in the Workflow

The workflow includes the following jobs:

secret-scanning

The secret-scanning workflow is designed to identify sensitive information such as API keys, passwords, and other secrets within your codebase. By integrating secret scanning into your CI/CD pipeline, developers can proactively prevent the accidental exposure of confidential data, enhancing the overall security posture of the application.

sast

The sast component focuses on Static Application Security Testing (SAST) to analyze your source code for vulnerabilities without executing it. This component helps in identifying security flaws early in the development cycle, ensuring that code quality and security are prioritized before deployment.

software composition analysis (SCA)

The software-composition-analysis workflow performs Software Composition Analysis (SCA) to detect vulnerabilities in your project’s dependencies. It scans your software for outdated or vulnerable third-party libraries, helping you manage risks early in the development process.

build image

This workflow uses Kaniko to build and archive a Docker image. The image tag is created based on user inputs, Git tags, or commit information. The image is built, saved as a .tar file, and the digest is retrieved using crane. Finally, the image, tag, and digest are uploaded as artifacts. To use this component, you need to have a Dockerfile in your repository's root directory.

container-scanning

The container-scanning component scans your container images for vulnerabilities. This ensures that your Docker images do not contain known vulnerabilities before they are deployed.

deploy

The devguard-deploy component deploys the created OCI (Open Container Initiative) image to the GitLab container registry. This ensures that your images are securely stored and ready for deployment in your infrastructure. The deploy workflow can only be executed if the following prerequisites run successfully: build-image, container-scanning, software-composition-analysis, sast, and secret-scanning.

Full DevGuard Scan

You can run all the previous jobs by calling the Full DevGuard Scan workflow.

Full DevGuard Scan Workflow Inputs

The reusable workflow accepts the following inputs:

Name Description Required Default Value Workflows Using This Input
asset-name Name of the asset to be scanned Yes SCA, Container Scanning
api-url URL of the DevGuard API No https://api.main.devguard.org SCA, Container Scanning
sca-path Path to the source code to be scanned No . SCA
image-destination-path Path to the OCI image to be scanned. Only necessary if the reusable workflow is not used for further processing of the built image.tar No image.tar Build-image
image OCI image tag No Build-image
context Path to the OCI context No . Build-image
dockerfile Path to the Dockerfile No Dockerfile Build-image
should-deploy Whether the deploy job should run, publishing the image to the desired Container Registry No true deploy

Secrets

To authenticate with the DevGuard API, the following secret is required:

Name Description Required
devguard-token DevGuard API token Yes

Usage Example

Here’s an example of how to call this reusable workflow from another workflow file:

on:
  push

jobs:
  vulnerability-scan:
    uses: l3montree-dev/devguard-action/.github/workflows/full.yml@main
    with:
      asset-name: 'my-application'
    secrets:
      devguard-token: ${{ secrets.DEVGUARD_TOKEN }}