diff --git a/.gitea/workflows/scan.yml b/.gitea/workflows/scan.yml
deleted file mode 100644
index 16ff031..0000000
--- a/.gitea/workflows/scan.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Security Scan
-on:
- workflow_dispatch:
- schedule:
- # Midnight every Monday
- - cron: '0 0 * * 1'
-
-jobs:
- lint:
- name: Scan Repositories
- runs-on: [security-runner]
-
- steps:
- - name: Checkout Source Files
- uses: actions/checkout@v4
-
- - name: Install Binaries
- run: |
- sudo apt-get install gitleaks trivy
- curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
- curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sudo sh -s -- -b /usr/local/bin
-
- - name: PNPM
- uses: pnpm/action-setup@v2
- with:
- version: 10
-
- - name: Install Dependencies
- run: pnpm i -g snyk
-
- - name: Run scan
- run: ./cron.sh
diff --git a/cron.sh b/cron.sh
deleted file mode 100755
index a4e45ed..0000000
--- a/cron.sh
+++ /dev/null
@@ -1,87 +0,0 @@
-# Create the directories for the reports.
-mkdir ./gitleaks;
-mkdir ./trivy;
-mkdir ./grype;
-mkdir ./syft;
-mkdir ./snyk;
-mkdir ./deps;
-
-# List of repositories to scan.
-repositories=("typescript-config" "boost-monitor" "tingle-bot" "rig-task-bot" "blog" "mod-logs" "a4p-bot" "mod-bot" "rosalia-nightsong" "eslint-config" "logger" "aria-iuvo" "cordelia-taryne" "melody-iuvo" "nginx-configs" "website-headers" "discord-rpc" "portfolio" "forms" "static-pages" "ocean-breeze" "becca-lyria" "docs" "gwen-abalise" "nails" "maylin-taryne");
-html=();
-current_dir=$(pwd);
-
-for directory in "${repositories[@]}"; do
- echo "Scanning $directory";
-
- git clone https://git.nhcarrigan.com/nhcarrigan/$directory ./_repos/$directory;
-
- # Automated scanning tools
- gitleaks detect --source ./_repos/$directory -r ./gitleaks/$directory.json --no-banner;
- trivy repo --format json --output ./trivy/$directory.json ./_repos/$directory;
- grype -o json --file ./grype/$directory.json ./_repos/$directory;
- syft scan ./_repos/$directory -o json=./syft/$directory.json;
-
- # Need to move directories for Snyk to track the target correctly.
- cd ./_repos/$directory;
- snyk test --dev --json --json-file-output=./_repos/security/snyk/$directory.json ./_repos/$directory;
- cd $current_dir;
-
- # Manual dependency version checks (no reliable package to do this for us :/ )
- echo "No supported package manager found in this project." > ./_repos/security/deps/$directory.txt;
- if [ -f ./_repos/$directory/package.json ]; then
- cd ./_repos/$directory;
- pnpm outdated | grep -v "^WARN" > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/Pipfile ]; then
- cd ./_repos/$directory;
- pip list --outdated > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/*.csproj ]; then
- cd ./_repos/$directory;
- dotnet list package --outdated > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/go.mod ]; then
- cd ./_repos/$directory;
- go list -m -u all > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/rockspec ]; then
- cd ./_repos/$directory;
- luarocks list --outdated > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/composer.json ]; then
- cd ./_repos/$directory;
- composer outdated --format=json > ./_repos/security/deps/$directory.json;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/Gemfile ]; then
- cd ./_repos/$directory;
- bundle outdated > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- if [ -f ./_repos/$directory/Cargo.toml ]; then
- cd ./_repos/$directory;
- cargo outdated > ./_repos/security/deps/$directory.txt;
- cd current_dir
- fi;
- html+=("
$directory
Outdated Dependencies");
-
- # Remove just to be sure - I THINK runner cleans up after itself.
- rm -rf ./_repos/$directory;
-done;
-
-echo "Security AuditsSecurity Audits
A collection of the various reporting tools we run against our repositories.
Contributions to resolve a reported issue are welcomed!
" > ./index.html;
-
-# Deploy the reports
-cp -r ./deps /home/nhcarrigan/security;
-cp -r ./gitleaks /home/nhcarrigan/security;
-cp -r ./trivy /home/nhcarrigan/security;
-cp -r ./grype /home/nhcarrigan/security;
-cp -r ./syft /home/nhcarrigan/security;
-cp -r ./snyk /home/nhcarrigan/security;
-cp ./index.html /home/nhcarrigan/security;
diff --git a/scan.sh b/scan.sh
index ee6ef18..10c06cb 100755
--- a/scan.sh
+++ b/scan.sh
@@ -1,10 +1,11 @@
-# Clean existing reports.
+# Clean any existing reports.
rm -r ./gitleaks;
rm -r ./trivy;
rm -r ./grype;
rm -r ./syft;
rm -r ./snyk;
rm -r ./deps;
+rm ./index.html;
# Create the directories for the reports.
mkdir ./gitleaks;
@@ -14,74 +15,74 @@ mkdir ./syft;
mkdir ./snyk;
mkdir ./deps;
-# Parse directories for all of the projects we "own".
-repositories=($(find /home/naomi/code/naomi -maxdepth 1 -type d -not -name '.' -printf "%f\n" | sort));
+# List of repositories to scan.
+repositories=("typescript-config" "boost-monitor" "tingle-bot" "rig-task-bot" "blog" "mod-logs" "a4p-bot" "mod-bot" "rosalia-nightsong" "eslint-config" "logger" "aria-iuvo" "cordelia-taryne" "melody-iuvo" "nginx-configs" "website-headers" "discord-rpc" "portfolio" "forms" "static-pages" "ocean-breeze" "becca-lyria" "docs" "gwen-abalise" "nails" "maylin-taryne");
html=();
+current_dir=$(pwd);
for directory in "${repositories[@]}"; do
- if [ $directory == "naomi" ] || [ $directory == "security" ]; then
- continue;
- fi;
echo "Scanning $directory";
+ git clone https://git.nhcarrigan.com/nhcarrigan/$directory ./_repos/$directory;
+
# Automated scanning tools
- gitleaks detect --source /home/naomi/code/naomi/$directory -r ./gitleaks/$directory.json --no-banner;
- trivy repo --format json --output ./trivy/$directory.json /home/naomi/code/naomi/$directory;
- grype -o json --file ./grype/$directory.json /home/naomi/code/naomi/$directory;
- syft scan /home/naomi/code/naomi/$directory -o json=./syft/$directory.json;
+ gitleaks detect --source ./_repos/$directory -r ./gitleaks/$directory.json --no-banner;
+ trivy repo --format json --output ./trivy/$directory.json ./_repos/$directory;
+ grype -o json --file ./grype/$directory.json ./_repos/$directory;
+ syft scan ./_repos/$directory -o json=./syft/$directory.json;
# Need to move directories for Snyk to track the target correctly.
- cd /home/naomi/code/naomi/$directory;
- snyk monitor --dev --project-name=$directory --remote-repo-url=$(git remote get-url origin) /home/naomi/code/naomi/$directory;
- snyk test --dev --json --json-file-output=/home/naomi/code/naomi/security/snyk/$directory.json /home/naomi/code/naomi/$directory;
- cd /home/naomi/code/naomi/security;
+ cd ./_repos/$directory;
+ snyk monitor --dev --project-name=$directory --remote-repo-url=$(git remote get-url origin) $current_dir/$directory;
+ snyk test --dev --json --json-file-output=./_repos/security/snyk/$directory.json $current_dir/$directory;
+ cd $current_dir;
# Manual dependency version checks (no reliable package to do this for us :/ )
- echo "No supported package manager found in this project." > /home/naomi/code/naomi/security/deps/$directory.txt;
- if [ -f /home/naomi/code/naomi/$directory/package.json ]; then
- cd /home/naomi/code/naomi/$directory;
- pnpm outdated | grep -v "^WARN" > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ echo "No supported package manager found in this project." > $current_dir/deps/$directory.txt;
+ if [ -f ./_repos/$directory/package.json ]; then
+ cd ./_repos/$directory;
+ pnpm outdated | grep -v "^WARN" > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/Pipfile ]; then
- cd /home/naomi/code/naomi/$directory;
- pip list --outdated > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/Pipfile ]; then
+ cd ./_repos/$directory;
+ pip list --outdated > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/*.csproj ]; then
- cd /home/naomi/code/naomi/$directory;
- dotnet list package --outdated > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/*.csproj ]; then
+ cd ./_repos/$directory;
+ dotnet list package --outdated > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/go.mod ]; then
- cd /home/naomi/code/naomi/$directory;
- go list -m -u all > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/go.mod ]; then
+ cd ./_repos/$directory;
+ go list -m -u all > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/rockspec ]; then
- cd /home/naomi/code/naomi/$directory;
- luarocks list --outdated > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/rockspec ]; then
+ cd ./_repos/$directory;
+ luarocks list --outdated > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/composer.json ]; then
- cd /home/naomi/code/naomi/$directory;
- composer outdated --format=json > /home/naomi/code/naomi/security/deps/$directory.json;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/composer.json ]; then
+ cd ./_repos/$directory;
+ composer outdated --format=json > $current_dir/deps/$directory.json;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/Gemfile ]; then
- cd /home/naomi/code/naomi/$directory;
- bundle outdated > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/Gemfile ]; then
+ cd ./_repos/$directory;
+ bundle outdated > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
- if [ -f /home/naomi/code/naomi/$directory/Cargo.toml ]; then
- cd /home/naomi/code/naomi/$directory;
- cargo outdated > /home/naomi/code/naomi/security/deps/$directory.txt;
- cd /home/naomi/code/naomi/security;
+ if [ -f ./_repos/$directory/Cargo.toml ]; then
+ cd ./_repos/$directory;
+ cargo outdated > $current_dir/deps/$directory.txt;
+ cd current_dir
fi;
html+=("$directory
Outdated Dependencies");
+
done;
-echo "Security AuditsSecurity Audits
A collection of the various reporting tools we run against our repositories.
Contributions to resolve a reported issue are welcomed!
" > ./index.html;
+rm -rf ./_repos;
-# Deploy the reports to the production server.
-GLOBIGNORE='.git' scp -r ./* prod:/home/nhcarrigan/security
\ No newline at end of file
+echo "Security AuditsSecurity Audits
A collection of the various reporting tools we run against our repositories.
Contributions to resolve a reported issue are welcomed!
Updated: ${date}
" > ./index.html;