Skip to content

Commit 33fd7c9

Browse files
dervoetidervoeti
committed
Merge branch 'dev' of https://github.com/MaibornWolff/SecObserve into stackable
2 parents 3f0049a + bb286ef commit 33fd7c9

66 files changed

Lines changed: 3078 additions & 986 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build_push_release.yml‎

Lines changed: 93 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ jobs:
205205
| sbom-utility patch --patch-file ./configuration/patch_supplier.json --quiet --input-file - \
206206
| sbom-utility patch --patch-file ./configuration/patch_complete.json --quiet --input-file - --output-file sbom_"$VERSION".json
207207
sbom-utility validate --input-file sbom_"$VERSION".json
208-
-
208+
-
209209
name: Commit SBOMs
210210
uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
211211
with:
@@ -214,3 +214,95 @@ jobs:
214214
commit_message: "chore: generate SBOMs for release ${{ github.event.inputs.release }}"
215215
branch: "chore/sboms_release_${{ github.event.inputs.release }}"
216216
file_pattern: "sbom/sbom*.json"
217+
-
218+
name: Merge SBOM branch into main and delete branch
219+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
220+
env:
221+
VERSION: ${{ github.event.inputs.release }}
222+
with:
223+
github-token: ${{ secrets.GITHUB_TOKEN }}
224+
script: |
225+
const sbomBranch = `chore/sboms_release_${process.env.VERSION}`;
226+
const targetBranch = 'main';
227+
228+
console.log(`Merging branch ${sbomBranch} into ${targetBranch}`);
229+
230+
try {
231+
// Merge the SBOM branch into main
232+
await github.rest.repos.merge({
233+
owner: context.repo.owner,
234+
repo: context.repo.repo,
235+
base: targetBranch,
236+
head: sbomBranch,
237+
commit_message: `chore: merge SBOM files for release ${process.env.VERSION}`
238+
});
239+
240+
console.log(`Successfully merged ${sbomBranch} into ${targetBranch}`);
241+
242+
// Delete the SBOM branch after successful merge
243+
console.log(`Deleting branch ${sbomBranch}`);
244+
await github.rest.git.deleteRef({
245+
owner: context.repo.owner,
246+
repo: context.repo.repo,
247+
ref: `heads/${sbomBranch}`
248+
});
249+
250+
console.log(`Successfully deleted branch ${sbomBranch}`);
251+
} catch (error) {
252+
console.error(`Error during merge or branch deletion: ${error.message}`);
253+
core.setFailed(error.message);
254+
}
255+
-
256+
name: Add SBOMs to GitHub Release
257+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
258+
env:
259+
VERSION: ${{ github.event.inputs.release }}
260+
with:
261+
github-token: ${{ secrets.GITHUB_TOKEN }}
262+
script: |
263+
const fs = require('fs');
264+
const path = require('path');
265+
const version = process.env.VERSION;
266+
const releaseTag = `v${version}`;
267+
268+
console.log(`Adding SBOMs to GitHub release ${releaseTag}`);
269+
270+
try {
271+
// Get the release by tag
272+
const { data: release } = await github.rest.repos.getReleaseByTag({
273+
owner: context.repo.owner,
274+
repo: context.repo.repo,
275+
tag: releaseTag
276+
});
277+
278+
// SBOM files to upload
279+
const sbomFiles = [
280+
`sbom_backend_application_${version}.json`,
281+
`sbom_frontend_application_${version}.json`,
282+
`sbom_backend_container_${version}.json`,
283+
`sbom_frontend_container_${version}.json`,
284+
`sbom_${version}.json`
285+
];
286+
287+
// Upload each SBOM file to the release
288+
for (const file of sbomFiles) {
289+
const filePath = path.join('./sbom', file);
290+
291+
console.log(`Uploading ${filePath} to release ${releaseTag}`);
292+
293+
const fileContent = fs.readFileSync(filePath);
294+
295+
await github.rest.repos.uploadReleaseAsset({
296+
owner: context.repo.owner,
297+
repo: context.repo.repo,
298+
release_id: release.id,
299+
name: file,
300+
data: fileContent
301+
});
302+
303+
console.log(`Successfully uploaded ${file} to release ${releaseTag}`);
304+
}
305+
} catch (error) {
306+
console.error(`Error adding SBOMs to release: ${error.message}`);
307+
core.setFailed(error.message);
308+
}

‎.github/workflows/check_backend.yml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,4 +62,34 @@ jobs:
6262
- name: Unittests
6363
run: |
6464
docker build -f docker/backend/unittests/django/Dockerfile -t secobserve_backend_unittests:latest .
65-
docker run --rm --env-file docker/backend/unittests/envs/django --env-file docker/backend/unittests/envs/sqlite secobserve_backend_unittests:latest /start
65+
docker run --rm \
66+
--volume ./backend:/home \
67+
--env-file docker/backend/unittests/envs/django \
68+
--env-file docker/backend/unittests/envs/sqlite \
69+
secobserve_backend_unittests:latest
70+
- name: "Upload coverage report"
71+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
72+
with:
73+
name: coverage-report
74+
path: backend/coverage.xml
75+
retention-days: 1
76+
77+
check_code_sonarqube_backend:
78+
if: github.repository == 'MaibornWolff/SecObserve'
79+
needs: [unittests]
80+
runs-on: ubuntu-latest
81+
steps:
82+
- name: Checkout code
83+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
84+
with:
85+
fetch-depth: 0
86+
- name: Download a single artifact
87+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
88+
with:
89+
name: coverage-report
90+
- name: Run SonarQube scan for backend
91+
uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
92+
env:
93+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
94+
with:
95+
projectBaseDir: backend

‎.github/workflows/check_frontend.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,20 @@ jobs:
4040
cd ..
4141
docker compose -f docker-compose-playwright.yml build
4242
docker compose -f docker-compose-playwright.yml up --abort-on-container-exit --exit-code-from playwright
43+
44+
check_code_sonarqube_frontend:
45+
if: github.repository == 'MaibornWolff/SecObserve'
46+
runs-on: ubuntu-latest
47+
steps:
48+
-
49+
name: Checkout code
50+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
51+
with:
52+
fetch-depth: 0
53+
-
54+
name: Run SonarQube scan for frontend
55+
uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
56+
env:
57+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_FRONTEND }}
58+
with:
59+
projectBaseDir: frontend

‎.github/workflows/check_licenses_dev.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,14 @@ jobs:
5555
so_api_token: ${{ secrets.SO_API_TOKEN }}
5656
-
5757
name: Check licenses for backend application
58-
uses: MaibornWolff/purl-patrol@c11a9181b28143386d730aef6e1fed9aef51e2e6 # v1.6.1
58+
uses: MaibornWolff/purl-patrol@fe0da8d7c02235dfdf3c52ec936873e57e37203d # v1.6.2
5959
with:
6060
SBOM_PATH: 'sbom_backend_application.json'
6161
LICENSE_POLICY_PATH: 'sbom/configuration/license_policy.json'
6262
BREAK_ENABLED: false
6363
-
6464
name: Check licenses for frontend application
65-
uses: MaibornWolff/purl-patrol@c11a9181b28143386d730aef6e1fed9aef51e2e6 # v1.6.1
65+
uses: MaibornWolff/purl-patrol@fe0da8d7c02235dfdf3c52ec936873e57e37203d # v1.6.2
6666
with:
6767
SBOM_PATH: 'sbom_frontend_application.json'
6868
LICENSE_POLICY_PATH: 'sbom/configuration/license_policy.json'

‎.github/workflows/check_vulnerabilities.yml‎

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -18,37 +18,3 @@ jobs:
1818
with:
1919
so_configuration: 'so_configuration_code.yml'
2020
SO_API_TOKEN: ${{ secrets.SO_API_TOKEN }}
21-
22-
check_code_sonarqube_backend:
23-
if: github.repository == 'MaibornWolff/SecObserve'
24-
runs-on: ubuntu-latest
25-
steps:
26-
-
27-
name: Checkout code
28-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29-
with:
30-
fetch-depth: 0
31-
-
32-
name: Run SonarQube scan for backend
33-
uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
34-
env:
35-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
36-
with:
37-
projectBaseDir: backend
38-
39-
check_code_sonarqube_frontend:
40-
if: github.repository == 'MaibornWolff/SecObserve'
41-
runs-on: ubuntu-latest
42-
steps:
43-
-
44-
name: Checkout code
45-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
46-
with:
47-
fetch-depth: 0
48-
-
49-
name: Run SonarQube scan for frontend
50-
uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
51-
env:
52-
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN_FRONTEND }}
53-
with:
54-
projectBaseDir: frontend

‎.github/workflows/scan_sca_current.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
name: Checkout
1717
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1818
with:
19-
ref: 'v1.32.1'
19+
ref: 'v1.33.0'
2020
-
2121
name: Run SCA vulnerability scanners
2222
uses: MaibornWolff/secobserve_actions_templates/actions/vulnerability_scanner@03881bede1d05a40887bf26d8dfd7a1a37be892d # main

‎.github/workflows/scorecard.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,6 @@ jobs:
6767

6868
# Upload the results to GitHub's code scanning dashboard.
6969
- name: "Upload to code-scanning"
70-
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
70+
uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
7171
with:
7272
sarif_file: results.sarif

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ keycloak/h2/keycloakdb.trace.db
1515
keycloak/h2/keycloakdb.lock.db
1616
keycloak/h2/keycloakdb.mv.db
1717
backend/application/import_observations/parsers/trivy_operator_prometheus_file
18+
coverage.xml

‎backend/application/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
__version__ = "1.32.1"
1+
__version__ = "1.33.0"
22

33
import pymysql
44

‎backend/application/commons/api/views.py‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
from typing import Union
2-
31
import environ
42
from rest_framework.decorators import action
53
from rest_framework.exceptions import ValidationError
@@ -71,7 +69,7 @@ def get(self, request: Request) -> Response:
7169
if env("EMAIL_HOST", default="") or env("EMAIL_PORT", default=""):
7270
features.append("feature_email")
7371

74-
content: dict[str, Union[int, list[str]]] = {
72+
content: dict[str, (int | list[str])] = {
7573
"features": features,
7674
}
7775

0 commit comments

Comments
 (0)