Merge pull request #6 from nvsecurity/NV-4418-gitlab-pipeline-self-co… #33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ## SETUP | |
| ## Run before activating pipeline | |
| # nightvision app create javaspringvulny-api | |
| # nightvision target create javaspringvulny-api https://127.0.0.1:9000 --type api | |
| # nightvision auth playwright create javaspringvulny-api https://127.0.0.1:9000 | |
| ## Optional steps can be preformed locally or in the pipeline | |
| # nightvision swagger extract ./ -t javaspringvulny-api --lang spring | |
| # nightvision scan javaspringvulny-api -a javaspringvulny-api --auth javaspringvulny-api | |
| name: Test Case - Java Spring App | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # Do not run the DAST scan when a push touches only files that cannot affect the | |
| # scanned app or the scan itself: docs, other-platform CI glue, and the manual-only | |
| # sibling notification workflows. App source, specs, Dockerfile/compose, build files, | |
| # scan config, and this workflow still trigger a scan. (NV-4462.) | |
| paths-ignore: | |
| - '**/*.md' | |
| - '.gitignore' | |
| - '.gitlab-ci.yml' | |
| - 'convert_sarif_to_gitlab.py' | |
| - 'azure-pipelines.yml' | |
| - 'sarif_to_azure_devops.py' | |
| - 'bitbucket-pipelines.yml' | |
| - 'Jenkinsfile' | |
| - '.github/workflows/nightvision-email.yml' | |
| - '.github/workflows/nightvision-slack.yml' | |
| - '.github/workflows/nightvision-teams.yml' | |
| workflow_dispatch: | |
| env: | |
| NIGHTVISION_TOKEN: ${{ secrets.NIGHTVISION_TOKEN }} | |
| NIGHTVISION_TARGET: javaspringvulny-api | |
| NIGHTVISION_AUTH: javaspringvulny-api | |
| jobs: | |
| test: | |
| permissions: | |
| security-events: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: (1) Clone Code | |
| uses: actions/checkout@v3 | |
| - name: (2) Install NightVision | |
| run: | | |
| wget -c https://downloads.nightvision.net/binaries/latest/nightvision_latest_linux_amd64.tar.gz -O - | tar -xz; sudo mv nightvision /usr/local/bin/ | |
| python -m pip install semgrep --user | |
| # Extract the spec to a local file and assert it is non-empty. The '|| true' mask | |
| # and the backup-spec fallback are dropped so a real API Discovery regression turns | |
| # the run red instead of silently scanning with a stale spec. (NV-4462.) | |
| - name: (3) Extract API documentation from code | |
| run: | | |
| nightvision swagger extract ./ --lang spring -o openapi-spec.yml --no-upload | |
| test -s openapi-spec.yml | |
| # Spring Boot + Postgres cold start (after the Gradle image build) routinely | |
| # exceeds a fixed sleep, and compose's depends_on waits only for container start, | |
| # not for the app to accept connections. Poll until it responds (any HTTP status | |
| # means it is listening) instead of sleeping a flat 10s; on timeout, dump logs and | |
| # fail loudly rather than letting the scan flake later. --retry-max-time caps the | |
| # whole loop (~150s) so a listening-but-hung port fails fast instead of burning | |
| # --max-time on every one of --retry attempts. (NV-4462.) | |
| - name: (4) Start the app and wait until it is ready | |
| run: | | |
| docker compose up -d | |
| if ! curl -sk --retry 60 --retry-delay 2 --retry-max-time 150 --retry-all-errors --max-time 5 -o /dev/null https://127.0.0.1:9000/; then | |
| echo "App did not become ready in time; recent compose logs:" | |
| docker compose logs --no-color --tail 200 | |
| exit 1 | |
| fi | |
| - name: (5) Scan the API | |
| run: | | |
| nightvision scan ${NIGHTVISION_TARGET} --auth ${NIGHTVISION_AUTH} > scan-results.txt | |
| nightvision export sarif -s "$(head -n 1 scan-results.txt)" --swagger-file openapi-spec.yml | |
| - name: (6) Upload SARIF file to GitHub Security Alerts if vulnerabilities are found | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: success() | |
| with: | |
| sarif_file: results.sarif |