diff --git a/.gitea/workflows/scan.yml b/.gitea/workflows/scan.yml deleted file mode 100644 index 16ff031..0000000 --- a/.gitea/workflows/scan.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: Security Scan -on: - workflow_dispatch: - schedule: - # Midnight every Monday - - cron: '0 0 * * 1' - -jobs: - lint: - name: Scan Repositories - runs-on: [security-runner] - - steps: - - name: Checkout Source Files - uses: actions/checkout@v4 - - - name: Install Binaries - run: | - sudo apt-get install gitleaks trivy - curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin - curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sudo sh -s -- -b /usr/local/bin - - - name: PNPM - uses: pnpm/action-setup@v2 - with: - version: 10 - - - name: Install Dependencies - run: pnpm i -g snyk - - - name: Run scan - run: ./cron.sh diff --git a/scan.sh b/scan.sh index ee6ef18..10c06cb 100755 --- a/scan.sh +++ b/scan.sh @@ -1,10 +1,11 @@ -# Clean existing reports. +# Clean any existing reports. rm -r ./gitleaks; rm -r ./trivy; rm -r ./grype; rm -r ./syft; rm -r ./snyk; rm -r ./deps; +rm ./index.html; # Create the directories for the reports. mkdir ./gitleaks; @@ -14,74 +15,74 @@ mkdir ./syft; mkdir ./snyk; mkdir ./deps; -# Parse directories for all of the projects we "own". -repositories=($(find /home/naomi/code/naomi -maxdepth 1 -type d -not -name '.' -printf "%f\n" | sort)); +# List of repositories to scan. +repositories=("typescript-config" "boost-monitor" "tingle-bot" "rig-task-bot" "blog" "mod-logs" "a4p-bot" "mod-bot" "rosalia-nightsong" "eslint-config" "logger" "aria-iuvo" "cordelia-taryne" "melody-iuvo" "nginx-configs" "website-headers" "discord-rpc" "portfolio" "forms" "static-pages" "ocean-breeze" "becca-lyria" "docs" "gwen-abalise" "nails" "maylin-taryne"); html=(); +current_dir=$(pwd); for directory in "${repositories[@]}"; do - if [ $directory == "naomi" ] || [ $directory == "security" ]; then - continue; - fi; echo "Scanning $directory"; + git clone https://git.nhcarrigan.com/nhcarrigan/$directory ./_repos/$directory; + # Automated scanning tools - gitleaks detect --source /home/naomi/code/naomi/$directory -r ./gitleaks/$directory.json --no-banner; - trivy repo --format json --output ./trivy/$directory.json /home/naomi/code/naomi/$directory; - grype -o json --file ./grype/$directory.json /home/naomi/code/naomi/$directory; - syft scan /home/naomi/code/naomi/$directory -o json=./syft/$directory.json; + gitleaks detect --source ./_repos/$directory -r ./gitleaks/$directory.json --no-banner; + trivy repo --format json --output ./trivy/$directory.json ./_repos/$directory; + grype -o json --file ./grype/$directory.json ./_repos/$directory; + syft scan ./_repos/$directory -o json=./syft/$directory.json; # Need to move directories for Snyk to track the target correctly. - cd /home/naomi/code/naomi/$directory; - snyk monitor --dev --project-name=$directory --remote-repo-url=$(git remote get-url origin) /home/naomi/code/naomi/$directory; - snyk test --dev --json --json-file-output=/home/naomi/code/naomi/security/snyk/$directory.json /home/naomi/code/naomi/$directory; - cd /home/naomi/code/naomi/security; + cd ./_repos/$directory; + snyk monitor --dev --project-name=$directory --remote-repo-url=$(git remote get-url origin) $current_dir/$directory; + snyk test --dev --json --json-file-output=./_repos/security/snyk/$directory.json $current_dir/$directory; + cd $current_dir; # Manual dependency version checks (no reliable package to do this for us :/ ) - echo "No supported package manager found in this project." > /home/naomi/code/naomi/security/deps/$directory.txt; - if [ -f /home/naomi/code/naomi/$directory/package.json ]; then - cd /home/naomi/code/naomi/$directory; - pnpm outdated | grep -v "^WARN" > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + echo "No supported package manager found in this project." > $current_dir/deps/$directory.txt; + if [ -f ./_repos/$directory/package.json ]; then + cd ./_repos/$directory; + pnpm outdated | grep -v "^WARN" > $current_dir/deps/$directory.txt; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/Pipfile ]; then - cd /home/naomi/code/naomi/$directory; - pip list --outdated > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/Pipfile ]; then + cd ./_repos/$directory; + pip list --outdated > $current_dir/deps/$directory.txt; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/*.csproj ]; then - cd /home/naomi/code/naomi/$directory; - dotnet list package --outdated > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/*.csproj ]; then + cd ./_repos/$directory; + dotnet list package --outdated > $current_dir/deps/$directory.txt; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/go.mod ]; then - cd /home/naomi/code/naomi/$directory; - go list -m -u all > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/go.mod ]; then + cd ./_repos/$directory; + go list -m -u all > $current_dir/deps/$directory.txt; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/rockspec ]; then - cd /home/naomi/code/naomi/$directory; - luarocks list --outdated > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/rockspec ]; then + cd ./_repos/$directory; + luarocks list --outdated > $current_dir/deps/$directory.txt; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/composer.json ]; then - cd /home/naomi/code/naomi/$directory; - composer outdated --format=json > /home/naomi/code/naomi/security/deps/$directory.json; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/composer.json ]; then + cd ./_repos/$directory; + composer outdated --format=json > $current_dir/deps/$directory.json; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/Gemfile ]; then - cd /home/naomi/code/naomi/$directory; - bundle outdated > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/Gemfile ]; then + cd ./_repos/$directory; + bundle outdated > $current_dir/deps/$directory.txt; + cd current_dir fi; - if [ -f /home/naomi/code/naomi/$directory/Cargo.toml ]; then - cd /home/naomi/code/naomi/$directory; - cargo outdated > /home/naomi/code/naomi/security/deps/$directory.txt; - cd /home/naomi/code/naomi/security; + if [ -f ./_repos/$directory/Cargo.toml ]; then + cd ./_repos/$directory; + cargo outdated > $current_dir/deps/$directory.txt; + cd current_dir fi; html+=("

$directory

  • Outdated Dependencies"); + done; -echo "Security Audits

    Security Audits

    A collection of the various reporting tools we run against our repositories.

    Contributions to resolve a reported issue are welcomed!

    ${html[*]}
    " > ./index.html; +rm -rf ./_repos; -# Deploy the reports to the production server. -GLOBIGNORE='.git' scp -r ./* prod:/home/nhcarrigan/security \ No newline at end of file +echo "Security Audits

    Security Audits

    A collection of the various reporting tools we run against our repositories.

    Contributions to resolve a reported issue are welcomed!

    Updated: ${date}

    ${html[*]}
    " > ./index.html;