Skip to content

Commit 8ea5311

Browse files
suskindsuskind
committed
added Gitlab examples
1 parent 8d1e2e9 commit 8ea5311

File tree

6 files changed

+211
-0
lines changed

6 files changed

+211
-0
lines changed

‎README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,28 @@ Create a GitHub action using the following YAML examples:
5656

5757
----
5858

59+
## Gitlab
60+
61+
Create a `.gitlab-ci.yml` file using the following YAML examples:
62+
63+
### Running a scan on an **ephemeral** application in **blocking mode** (requires the `scanning-agent/farcasterd-linux-amd64-0.4.3` file)
64+
65+
- [YAML file](./cicd-examples/gitlab/gitlab-ephemeral-app-blocking-mode.yaml)
66+
- Configuration:
67+
- ![Gitlab config](./assets/gitlab-ephemeral-config.png)
68+
69+
### Running a scan on a **remote** target in **blocking mode**
70+
- [YAML file](./cicd-examples/gitlab/gitlab-remote-app-blocking-mode.yaml)
71+
- Configuration
72+
- ![Gitlab config](./assets/gitlab-remote-config.png)
73+
74+
### Running a scan on a **remote** target in **non-blocking mode**
75+
- [YAML file](./cicd-examples/gitlab/gitlab-remote-app-non-blocking-mode.yaml)
76+
- Configuration
77+
- ![Gitlab config](./assets/gitlab-remote-config.png)
78+
79+
----
80+
5981
## BitBucket
6082

6183
Create a `bitbucket-pipelines.yml` file using the following YAML examples:

‎assets/gitlab-ephemeral-config.png‎

139 KB
Loading

‎assets/gitlab-remote-config.png‎

92.5 KB
Loading

‎cicd-examples/gitlab/gitlab-ephemeral-app-blocking-mode.yaml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
stages:
2+
- build-and-test
3+
4+
build-and-test:
5+
stage: build-and-test
6+
image: docker:latest
7+
services:
8+
- docker:dind
9+
variables:
10+
DOCKER_HOST: tcp://docker:2375
11+
script:
12+
- apk add --no-cache curl jq python3 py3-pip
13+
- python3 -m venv venv
14+
- source ./venv/bin/activate
15+
# Install Probely CLI
16+
- pip install probely
17+
- probely targets get --api-key ${PROBELY_API_KEY}
18+
19+
- docker network create custom-network
20+
21+
- docker build -t test-app .
22+
- docker run --name test-app --hostname custom-web-app --network custom-network -p 0.0.0.0:8080:8080 -d test-app
23+
24+
- cat /etc/hosts # current /etc/hosts
25+
26+
- CONTAINER_IP=$(grep -i 'docker' /etc/hosts | head -1 | awk '{print $1}')
27+
- echo "Container IP from /etc/hosts is $CONTAINER_IP"
28+
- echo "${CONTAINER_IP} ${TARGET_HOSTNAME} ${TARGET_HOSTNAME}." | tee -a /etc/hosts # Add to /etc/hosts
29+
- cat /etc/hosts # Confirm host was added
30+
31+
- |
32+
for i in {1..10}; do # Wait for the app to start
33+
if curl -s ${TARGET_URL} > /dev/null; then
34+
echo "App is up!";
35+
break;
36+
fi
37+
echo "Waiting for the app to be ready...";
38+
sleep 2;
39+
done
40+
41+
# Test the application
42+
- RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" ${TARGET_URL})
43+
- |
44+
if [[ "$RESPONSE" -ne 200 ]]; then
45+
echo "App test failed with HTTP status ${RESPONSE}";
46+
exit 1;
47+
fi
48+
- curl -s -i ${TARGET_URL}
49+
- echo "App test passed with HTTP status ${RESPONSE}";
50+
51+
# Run userspace agent
52+
- chmod +x scanning-agent/farcasterd-linux-amd64-0.4.3
53+
- ./scanning-agent/farcasterd-linux-amd64-0.4.3 --token ${AGENT_TOKEN} &
54+
55+
# Wait for the agent to start
56+
- sleep 40
57+
58+
# Start Scan
59+
- |
60+
for i in {1..20}; do # Start Probely scan
61+
echo "-----------------------------------"
62+
SCAN_ID=$(probely targets start-scan ${TARGET_ID} -o IDS_ONLY --api-key ${PROBELY_API_KEY})
63+
echo ${SCAN_ID}
64+
if [[ -z "${SCAN_ID}" ]]; then
65+
echo "Scan didn't start... Retry start-scan"
66+
else
67+
echo "Scan started with SCAN ID ${SCAN_ID}";
68+
break;
69+
fi
70+
sleep 5
71+
done
72+
- |
73+
if [[ -z "${SCAN_ID}" ]]; then
74+
echo "No Scan ID, aborting..."
75+
exit 1
76+
fi
77+
78+
# Wait for scan to end
79+
- |
80+
while true; do
81+
echo "-----------------------------------"
82+
SCAN_OUTPUT=$(probely scans get ${SCAN_ID} --api-key ${PROBELY_API_KEY} | tail -1)
83+
echo ${SCAN_OUTPUT}
84+
echo "-----------------------------------"
85+
SCAN_STATUS=$(probely scans get ${SCAN_ID} --api-key ${PROBELY_API_KEY} -o JSON | jq -r '.[0].status')
86+
if [[ "$SCAN_STATUS" == "started" ]] || [[ "$SCAN_STATUS" == "queued" ]]; then
87+
echo "Scan is running or queued!";
88+
else
89+
echo "Scan is not running... finishing"
90+
break;
91+
fi
92+
sleep 30;
93+
done
94+
95+
# Check for high vulnerabilities
96+
- HIGH_VULNS=$(probely scans get ${SCAN_ID} --api-key ${PROBELY_API_KEY} -o JSON | jq -r '.[0].highs')
97+
- echo "HIGH vulnerabilities ${HIGH_VULNS}"
98+
- |
99+
if [[ "$HIGH_VULNS" -gt 0 ]]; then
100+
echo "Scan has High vulnerabilities... aborting"
101+
exit 1
102+
else
103+
echo "Scan doesn't have high vulnerabilities"
104+
fi
105+
106+
# Clean up
107+
- docker stop test-app
108+
- docker rm test-app
109+
- docker network rm custom-network

‎cicd-examples/gitlab/gitlab-remote-app-blocking-mode.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
stages:
2+
- scan
3+
4+
scan:
5+
stage: scan
6+
image: python:3.11-bullseye
7+
script:
8+
- apt-get update && apt-get install -y jq
9+
# Install Probely CLI
10+
- pip install probely
11+
- probely targets get --api-key ${PROBELY_API_KEY}
12+
- |
13+
for i in {1..20}; do
14+
echo "-----------------------------------"
15+
SCAN_ID=$(probely targets start-scan ${TARGET_ID} -o IDS_ONLY --api-key ${PROBELY_API_KEY})
16+
echo ${SCAN_ID}
17+
if [[ -z "$SCAN_ID" ]]; then
18+
echo "Scan didn't start... Retry start-scan"
19+
else
20+
echo "Scan started with SCAN ID ${SCAN_ID}";
21+
break;
22+
fi
23+
sleep 5
24+
done
25+
if [[ -z "$SCAN_ID" ]]; then
26+
echo "No Scan ID, aborting..."
27+
exit 1
28+
fi
29+
30+
- |
31+
while true; do
32+
echo "-----------------------------------"
33+
SCAN_OUTPUT=$(probely scans get ${SCAN_ID} --api-key ${PROBELY_API_KEY} | tail -1)
34+
echo ${SCAN_OUTPUT}
35+
echo "-----------------------------------"
36+
SCAN_STATUS=$(probely scans get ${SCAN_ID} --api-key ${PROBELY_API_KEY} -o JSON | jq -r '.[0].status')
37+
if [[ "$SCAN_STATUS" == "started" ]] || [[ "$SCAN_STATUS" == "queued" ]]; then
38+
echo "Scan is running or queued!";
39+
else
40+
echo "Scan is not running... finishing"
41+
break;
42+
fi
43+
sleep 30;
44+
done
45+
46+
- HIGH_VULNS=$(probely scans get ${SCAN_ID} --api-key ${PROBELY_API_KEY} -o JSON | jq -r '.[0].highs')
47+
- echo "HIGH risk vulnerabilities ${HIGH_VULNS}"
48+
- |
49+
if [[ "$HIGH_VULNS" -gt 0 ]]; then
50+
echo "Scan has High risk vulnerabilities... aborting"
51+
exit 1
52+
else
53+
echo "Scan doesn't have High risk vulnerabilities"
54+
fi

‎cicd-examples/gitlab/gitlab-remote-app-non-blocking-mode.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
stages:
2+
- scan
3+
4+
scan:
5+
stage: scan
6+
image: python:latest
7+
script:
8+
- pip install probely
9+
- probely targets get --api-key ${PROBELY_API_KEY}
10+
- |
11+
for i in {1..20}; do
12+
echo "-----------------------------------"
13+
SCAN_ID=$(probely targets start-scan ${TARGET_ID} -o IDS_ONLY --api-key ${PROBELY_API_KEY})
14+
echo ${SCAN_ID}
15+
if [[ -z "$SCAN_ID" ]]; then
16+
echo "Scan didn't start... Retry start-scan"
17+
else
18+
echo "Scan started with SCAN ID: ${SCAN_ID}";
19+
break;
20+
fi
21+
sleep 5
22+
done
23+
if [[ -z "$SCAN_ID" ]]; then
24+
echo "No Scan ID, aborting..."
25+
exit 1
26+
fi

0 commit comments

Comments
 (0)