fix: log the curl results, pipx for semgrep

.gitea/workflows/security.yml

@@ -23,16 +23,27 @@ jobs:
       - name: Ensure DefectDojo Product Exists
         env:
           DD_URL: ${{ secrets.DD_URL }}
-          # UPDATED: Using DD_TOKEN now
           DD_TOKEN: ${{ secrets.DD_TOKEN }}
           PRODUCT_NAME: ${{ github.repository }} 
           PRODUCT_TYPE_ID: 1 
         run: |
           sudo apt-get install jq -y > /dev/null
           
-          # Check if product exists
-          RESPONSE=$(curl -s -H "Authorization: Token $DD_TOKEN" "$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
-          COUNT=$(echo "$RESPONSE" | jq -r '.count')
+          echo "Checking connection to $DD_URL..."
+          
+          # Check if product exists - capture HTTP code to debug connection issues
+          RESPONSE=$(curl --write-out "%{http_code}" --silent --output /tmp/response.json \
+            -H "Authorization: Token $DD_TOKEN" \
+            "$DD_URL/api/v2/products/?name=$PRODUCT_NAME")
+          
+          # If response is not 200, print error
+          if [ "$RESPONSE" != "200" ]; then
+            echo "::error::Failed to query DefectDojo. HTTP Code: $RESPONSE"
+            cat /tmp/response.json
+            exit 1
+          fi
+
+          COUNT=$(cat /tmp/response.json | jq -r '.count')
           
           if [ "$COUNT" = "0" ]; then
             echo "Creating product '$PRODUCT_NAME'..."
@@ -57,15 +68,27 @@ jobs:
           trivy fs . --scanners vuln,misconfig --format json --output trivy-results.json --exit-code 0
 
       - name: Upload Trivy to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
         run: |
-          curl -X POST "${{ secrets.DD_URL }}/api/v2/import-scan/" \
-            -H "Authorization: Token ${{ secrets.DD_TOKEN }}" \
+          echo "Uploading Trivy results..."
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
             -F "active=true" \
             -F "verified=true" \
             -F "scan_type=Trivy Scan" \
             -F "engagement_name=CI/CD Pipeline" \
             -F "product_name=${{ github.repository }}" \
-            -F "file=@trivy-results.json"
+            -F "file=@trivy-results.json")
+          
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+            echo "::error::Upload Failed with HTTP $HTTP_CODE"
+            cat response.txt
+            exit 1
+          else
+            echo "Upload Success!"
+          fi
 
       # --- 2. GITLEAKS (Secrets) ---
       - name: Install Gitleaks
@@ -78,32 +101,58 @@ jobs:
         run: gitleaks detect --source . -v --report-path gitleaks-results.json --report-format json --no-git || true
 
       - name: Upload Gitleaks to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
         run: |
-          curl -X POST "${{ secrets.DD_URL }}/api/v2/import-scan/" \
-            -H "Authorization: Token ${{ secrets.DD_TOKEN }}" \
+          echo "Uploading Gitleaks results..."
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
             -F "active=true" \
             -F "verified=true" \
             -F "scan_type=Gitleaks Scan" \
             -F "engagement_name=CI/CD Pipeline" \
             -F "product_name=${{ github.repository }}" \
-            -F "file=@gitleaks-results.json"
+            -F "file=@gitleaks-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             cat response.txt
+             exit 1
+          else
+             echo "Upload Success!"
+          fi
 
       # --- 3. SEMGREP (SAST) ---
-      - name: Install Semgrep
+      - name: Install Semgrep (via pipx)
         run: |
-          sudo apt-get install python3-pip -y
-          pip install semgrep
+          sudo apt-get install pipx -y
+          pipx install semgrep
+          # Add pipx binary path to GITHUB_PATH so next steps can see 'semgrep'
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
       - name: Run Semgrep
         run: semgrep scan --config=p/security-audit --config=p/owasp-top-ten --json --output semgrep-results.json . || true
 
       - name: Upload Semgrep to DefectDojo
+        env:
+          DD_URL: ${{ secrets.DD_URL }}
+          DD_TOKEN: ${{ secrets.DD_TOKEN }}
         run: |
-          curl -X POST "${{ secrets.DD_URL }}/api/v2/import-scan/" \
-            -H "Authorization: Token ${{ secrets.DD_TOKEN }}" \
+          echo "Uploading Semgrep results..."
+          HTTP_CODE=$(curl --write-out "%{http_code}" --output response.txt --silent -X POST "$DD_URL/api/v2/import-scan/" \
+            -H "Authorization: Token $DD_TOKEN" \
             -F "active=true" \
             -F "verified=true" \
             -F "scan_type=Semgrep JSON Report" \
             -F "engagement_name=CI/CD Pipeline" \
             -F "product_name=${{ github.repository }}" \
-            -F "file=@semgrep-results.json"
+            -F "file=@semgrep-results.json")
+
+          if [[ "$HTTP_CODE" != "200" && "$HTTP_CODE" != "201" ]]; then
+             echo "::error::Upload Failed with HTTP $HTTP_CODE"
+             cat response.txt
+             exit 1
+          else
+             echo "Upload Success!"
+          fi