Merge pull request #2 from 223159756/engine-merge

Engine merge

Author: 6igby

.DS_Store

@@ -0,0 +1,41 @@
+name: Run Collector
+
+on:
+  push:
+    branches: [Compliance-Engine]
+    
+jobs:
+  run-collector:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install deps
+        run: pip install google-api-python-client google-auth google-auth-httplib2 google-auth-oauthlib
+
+      - name: Run GCP Access Collector
+        env: 
+          GCP_CREDENTIALS: ${{ secrets.GCP_CREDENTIALS }}
+        run: |
+          python3 engine/GCPAccess.py
+          mv iam_policy.json test-configs/iam_policy.json
+          mv networks.json test-configs/networks.json
+
+      - name: Commit and push IAM policy & networks config
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add test-configs/iam_policy.json
+          git add test-configs/networks.json
+          git diff --cached --quiet && echo "No changes to commit" || git commit -m "Update iam_policy.json & networks.json"
+          git push origin Compliance-Engine
+        

.github/workflows/Collecter.yml

@@ -0,0 +1,27 @@
+name: Build Engine Branch
+
+on:
+  push:
+    branches: [Compliance-Engine]
+
+jobs:
+  build-engine-from-devops:
+    name: Build Engine Code 
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout engine branch code
+        uses: actions/checkout@v3
+        with:
+          ref: Compliance-Engine
+
+      - name: Confirm branch
+        run: git branch
+
+      - name: Build container
+        run: |
+          docker build -t autoaudit/engine -f docker/engine.Dockerfile .
+
+      - name: Run engine container
+        run: |
+          docker run --rm autoaudit/engine

.github/workflows/engine-ci.yml

@@ -0,0 +1,53 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow checks out code, builds an image, performs a container image
+# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security
+# code scanning feature.  For more information on the Anchore scan action usage
+# and parameters, see https://github.com/anchore/scan-action. For more
+# information on Anchore's container image scanning tool Grype, see
+# https://github.com/anchore/grype
+name: Anchore Grype vulnerability scan
+
+on:
+  push:
+    branches: [Compliance-Engine]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [Compliance-Engine]
+  schedule:
+    - cron: '37 20 * * 4'
+
+permissions:
+  contents: read
+
+jobs:
+  Anchore-Build-Scan:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+    runs-on: ubuntu-latest
+    
+    steps:
+    - name: Check out the code
+      uses: actions/checkout@v4
+      
+    - name: Build the Docker image
+      run: docker build -t compliance-engine-workflows:latest -f docker/engine.Dockerfile .
+      
+    - name: Run the Anchore Grype scan action
+      uses: anchore/scan-action@v3
+      id: scan
+      
+      with:
+        image: docker:compliance-engine-workflows:latest
+        fail-build: true
+        severity-cutoff: critical
+        
+    - name: Upload vulnerability report
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: ${{ steps.scan.outputs.sarif }}

.github/workflows/gryp.yml

@@ -0,0 +1,9 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY engine/ ./engine/
+COPY rules/ ./rules/
+COPY test-configs/ ./test-configs/
+
+CMD ["python", "engine/main.py"]

.gitignore

@@ -0,0 +1,2 @@
+abcdaas
+a

docker/engine.Dockerfile

@@ -0,0 +1 @@
+aaa

engine/.trigger

@@ -0,0 +1,36 @@
+from google.oauth2 import service_account
+from googleapiclient.discovery import build
+from google.auth import default
+import json 
+import os
+
+service_account_info = json.loads(os.environ["GCP_CREDENTIALS"])
+creds = service_account.Credentials.from_service_account_info(
+    service_account_info,
+    scopes=["https://www.googleapis.com/auth/cloud-platform"],
+)
+
+crm_policy = build("cloudresourcemanager", "v3", credentials=creds)
+crm_compute = build("compute", "v1", credentials=creds)
+
+project_id = "coastal-stone-470308-a0"
+res_name = f"projects/{project_id}"
+
+policy = crm_policy.projects().getIamPolicy(
+    resource=res_name,
+    body={"options": {"requestedPolicyVersion": 3}}
+).execute()
+
+networks = []
+req = crm_compute.networks().list(project=project_id)
+while req is not None:
+    resp = req.execute()
+    networks.extend(resp.get("items", []))
+    req = crm_compute.networks().list_next(previous_request=req, previous_response=resp)
+
+with open("iam_policy.json", "w") as f:
+    json.dump(policy, f, indent=2)
+
+with open("networks.json", "w") as f:
+    json.dump(networks, f, indent=2)
+

engine/.trigger2

@@ -0,0 +1,32 @@
+package AutoAudit_tester.engine.Helpers
+
+import future.keywords.in
+
+get(path) = v if {
+  parts := split(path, ".")
+  some i
+  pv := walk(input)[i]
+  p := pv[0]
+  v := pv[1]
+  p == parts
+}
+equals(path, expected) if {
+  get(path) == expected
+}
+
+in_whitelist(path, allowed) if {
+  val := get(path)
+  val in allowed
+}
+not_in_blacklist(path, blocked) if {
+  val := get(path)
+  not val in blocked
+}
+status(bool) = s if {
+  bool
+  s := "Compliant"
+}
+status(bool) = s if {
+  not bool
+  s := "NonCompliant"
+}