Skip to content

Commit 09cc0e5

Browse files
kishore7snehilkishore7snehil
authored
Merge branch 'master' into dependabot/github_actions/actions/upload-pages-artifact-3
2 parents c5d493f + 49b8be4 commit 09cc0e5

File tree

17 files changed

+978
-724
lines changed

17 files changed

+978
-724
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
* @auth0/dx-sdks-engineer
1+
* @auth0/project-dx-sdks-engineer-codeowner

.github/actions/actions/get-prerelease/action.yml renamed to .github/actions/get-prerelease/action.yml

File renamed without changes.

.github/actions/actions/get-release-notes/action.yml renamed to .github/actions/get-release-notes/action.yml

File renamed without changes.

.github/actions/actions/get-version/action.yml renamed to .github/actions/get-version/action.yml

File renamed without changes.

.github/actions/actions/release-create/action.yml renamed to .github/actions/release-create/action.yml

File renamed without changes.

‎.github/actions/rl-scanner/action.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: "Reversing Labs Scanner"
2+
description: "Runs the Reversing Labs scanner on a specified artifact."
3+
inputs:
4+
artifact-path:
5+
description: "Path to the artifact to be scanned."
6+
required: true
7+
version:
8+
description: "Version of the artifact."
9+
required: true
10+
11+
runs:
12+
using: "composite"
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: "3.10"
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: "The outcome of the scan process."
71+
value: ${{ env.scan-status }}

.github/actions/actions/tag-exists/action.yml renamed to .github/actions/tag-exists/action.yml

File renamed without changes.

‎.github/workflows/publish.yml‎

Lines changed: 23 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,33 @@
11
name: Publish Release
22

33
on:
4-
pull_request:
5-
types:
6-
- closed
74
workflow_dispatch:
85

96
### TODO: Replace instances of './.github/actions/' with reference to the `dx-sdk-actions` repo is made public and this file is transferred over
107
### TODO: Also remove `get-prerelease`, `get-version`, `release-create`, `tag-create` and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
118

129
permissions:
13-
contents: read
10+
contents: write
1411
id-token: write # Required for trusted publishing to PyPI
1512

1613
jobs:
14+
rl-scanner:
15+
uses: ./.github/workflows/rl-scanner.yml
16+
with:
17+
node-version: 18
18+
artifact-name: "auth0-python.tgz"
19+
secrets:
20+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
21+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
22+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
23+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
24+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
25+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
1726
publish-pypi:
1827
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
1928
name: "PyPI"
2029
runs-on: ubuntu-latest
30+
needs: rl-scanner
2131
environment: release
2232

2333
steps:
@@ -26,7 +36,7 @@ jobs:
2636
with:
2737
fetch-depth: 0
2838
fetch-tags: true
29-
39+
3040
# Get the version from the branch name
3141
- id: get_version
3242
uses: ./.github/actions/get-version
@@ -42,21 +52,20 @@ jobs:
4252
- id: get_release_notes
4353
uses: ./.github/actions/get-release-notes
4454
with:
45-
token: ${{ secrets.github-token }}
55+
token: ${{ secrets.GITHUB_TOKEN }}
4656
version: ${{ steps.get_version.outputs.version }}
4757
repo_owner: ${{ github.repository_owner }}
4858
repo_name: ${{ github.event.repository.name }}
4959

50-
# Check if the tag already exists
51-
- id: tag_exists
52-
uses: ./.github/actions/tag-exists
60+
# Create a release for the tag
61+
- uses: ./.github/actions/release-create
5362
with:
63+
token: ${{ secrets.GITHUB_TOKEN }}
64+
name: ${{ steps.get_version.outputs.version }}
65+
body: ${{ steps.get_release_notes.outputs.release-notes }}
5466
tag: ${{ steps.get_version.outputs.version }}
55-
token: ${{ secrets.github-token }}
56-
57-
# If the tag already exists, exit with an error
58-
- if: steps.tag_exists.outputs.exists == 'true'
59-
run: exit 1
67+
commit: ${{ github.sha }}
68+
prerelease: ${{ steps.get_prerelease.outputs.prerelease }}
6069

6170
- name: Configure Python
6271
uses: actions/setup-python@v5
@@ -79,13 +88,3 @@ jobs:
7988
8089
- name: Publish release
8190
uses: pypa/gh-action-pypi-publish@release/v1
82-
83-
# Create a release for the tag
84-
- uses: ./.github/actions/release-create
85-
with:
86-
token: ${{ secrets.github-token }}
87-
name: ${{ steps.get_version.outputs.version }}
88-
body: ${{ steps.get_release_notes.outputs.release-notes }}
89-
tag: ${{ steps.get_version.outputs.version }}
90-
commit: ${{ github.sha }}
91-
prerelease: ${{ steps.get_prerelease.outputs.prerelease }}

‎.github/workflows/rl-scanner.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: RL-Secure Workflow
2+
name: RL-Secure Workflow
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
python-version:
8+
required: true
9+
type: string
10+
artifact-name:
11+
required: true
12+
type: string
13+
secrets:
14+
RLSECURE_LICENSE:
15+
required: true
16+
RLSECURE_SITE_KEY:
17+
required: true
18+
SIGNAL_HANDLER_TOKEN:
19+
required: true
20+
PRODSEC_TOOLS_USER:
21+
required: true
22+
PRODSEC_TOOLS_TOKEN:
23+
required: true
24+
PRODSEC_TOOLS_ARN:
25+
required: true
26+
27+
jobs:
28+
checkout-build-scan-only:
29+
runs-on: ubuntu-latest
30+
31+
permissions:
32+
pull-requests: write
33+
id-token: write
34+
35+
steps:
36+
- uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 0
39+
fetch-tags: true
40+
41+
- name: Configure Python
42+
uses: actions/setup-python@v5
43+
with:
44+
python-version: ${{ inputs.python-version }}
45+
46+
- name: Configure dependencies
47+
run: |
48+
pip install --user --upgrade pip
49+
pip install --user pipx
50+
pipx ensurepath
51+
pipx install poetry==1.4.2
52+
pip install --upgrade pip
53+
pip install boto3 requests
54+
poetry config virtualenvs.in-project true
55+
poetry install --with dev
56+
poetry self add "poetry-dynamic-versioning[plugin]==1.1.1"
57+
58+
- name: Build release
59+
run: |
60+
poetry build
61+
62+
- name: Create tgz build artifact
63+
run: |
64+
tar -czvf ${{ inputs.artifact-name }} *
65+
66+
- name: Get Artifact Version
67+
id: get_version
68+
run: echo "version=$(cat .version)" >> $GITHUB_ENV
69+
70+
- name: Run RL Scanner
71+
id: rl-scan-conclusion
72+
uses: ./.github/actions/rl-scanner
73+
with:
74+
artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
75+
version: "${{ steps.get_version.outputs.version }}"
76+
env:
77+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
78+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
79+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
80+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
81+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
82+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
83+
84+
- name: Output scan result
85+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

‎.github/workflows/semgrep.yml‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: Semgrep
22

33
on:
44
merge_group:
5-
pull_request_target:
5+
pull_request:
66
types:
77
- opened
88
- synchronize
@@ -20,16 +20,7 @@ concurrency:
2020
cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
2121

2222
jobs:
23-
authorize:
24-
name: Authorize
25-
environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }}
26-
runs-on: ubuntu-latest
27-
steps:
28-
- run: true
29-
3023
run:
31-
needs: authorize # Require approval before running on forked pull requests
32-
3324
name: Check for Vulnerabilities
3425
runs-on: ubuntu-latest
3526

0 commit comments

Comments
 (0)