diff --git a/.github/workflows/mend.config b/.github/workflows/mend.config index 69d6fff..d94d682 100644 --- a/.github/workflows/mend.config +++ b/.github/workflows/mend.config @@ -2,7 +2,8 @@ # WhiteSource Unified-Agent configuration file for GO # GENERAL SCAN MODE: Package Managers only #################################################################### - +#Configuration Reference: https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html#General + # !!! Important for WhiteSource "DIST - *" Products: # Please set # checkPolicies=false @@ -21,25 +22,30 @@ failErrorLevel=ALL # failBuildOnPolicyViolation: # If the flag is true, the Unified Agent exit code will be the result of the policy check. # If the flag is false, the Unified Agent exit code will be the result of the scan. -forceUpdate.failBuildOnPolicyViolation=false +forceUpdate.failBuildOnPolicyViolation=true # offline parameter is important and need to be false offline=false # ignoreSourceFiles parameter is important and need to be true # IMPORTANT: This parameter is going to be deprecated in future # and will be replaced by a new parameter, fileSystemScan. -ignoreSourceFiles=true +# ignoreSourceFiles=true # fileSystemScan parameter is important and need to be false as a # replacement for ignoreSourceFiles=true and overrides the # soon-to-be-deprecated ignoreSourceFiles. -fileSystemScan=false +#To scan source files, we need to enable it. +fileSystemScan=true # resolveAllDependencies is important and need to be false resolveAllDependencies=false #wss.connectionTimeoutMinutes=60 # URL to your WhiteSource server. # wss.url=https://sap.whitesourcesoftware.com/agent - + +#################################################################### +# GO Configuration +#################################################################### + # resolveDependencies parameter is important and need to be true #if you are using 'modules' as a dependency manager, then the go.resolveDependencies is set to false. #For any other dependency manager, this value is set to true. @@ -47,7 +53,8 @@ resolveAllDependencies=false go.resolveDependencies=true #defaut value for ignoreSourceFiles is set to false # ignoreSourceFiles parameter is important and need to be true -go.ignoreSourceFiles=true +# To scan source files, we need to disable it. +go.ignoreSourceFiles=false go.collectDependenciesAtRuntime=false # dependencyManager: Determines the Go dependency manager to use when scanning a Go project. # Valid values are 'dep', 'godep', 'vndr', 'gogradle', 'glide', 'govendor', 'gopm' and 'vgo' @@ -61,12 +68,13 @@ go.collectDependenciesAtRuntime=false #Please comment these below 4 lines that has 'go.modules' prefix if you are not using the 'modules' dependency manager. # Default value is true. If set to true, it resolves Go Modules dependencies. go.modules.resolveDependencies=true -#default value is true. If set to true, this will ignore Go source files during the scan. -#go.modules.ignoreSourceFiles=true +#default value is true. If set to true, this will ignore Go source files during the scan. +#To scan source files, we need to disable it. +go.modules.ignoreSourceFiles=false #default value is true. If set to true, removes duplicate dependencies during Go Modules dependency resolution. #go.modules.removeDuplicateDependencies=false #default value is false. if set to true, scans Go Modules project test dependencies. -#go.modules.includeTestDependencies=true +go.modules.includeTestDependencies=true ###################### diff --git a/.github/workflows/mend_scan.yaml b/.github/workflows/mend_scan.yaml index 9c866d7..d77f9d1 100644 --- a/.github/workflows/mend_scan.yaml +++ b/.github/workflows/mend_scan.yaml @@ -3,6 +3,20 @@ name: Mend Security Scan on: schedule: - cron: '15 0 * * 0' + push: + branches: + - main + workflow_dispatch: + inputs: + logLevel: + description: 'Log level' + required: true + default: 'debug' + type: choice + options: + - info + - warning + - debug jobs: mend-scan: @@ -23,6 +37,11 @@ jobs: with: go-version-file: '${{ github.workspace }}/go.mod' + - name: 'Setup jq' + uses: dcarbone/install-jq-action@v2.1.0 + with: + version: '1.7' + - name: Download Mend Universal Agent run: curl https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar -o ./wss-unified-agent.jar @@ -34,4 +53,107 @@ jobs: WSS_URL: ${{ secrets.MEND_URL }} API_KEY: ${{ secrets.MEND_API_TOKEN }} CONFIG_FILE: './.github/workflows/mend.config' + + + - name: Generate Report + env: + USER_KEY: ${{ secrets.MEND_API_USER_KEY }} + PROJECT_TOKEN: ${{ secrets.MEND_PROJECT_TOKEN_MPAS }} + API_KEY: ${{ secrets.MEND_API_ORG_TOKEN }} + EMAIL: ${{ secrets.MEND_API_EMAIL }} + run: | + data=$(cat < 52 | select(.==true)'| wc -l ) + + function print { + printf "############################################\n$1\n############################################\n" + } + + function restricted_license { + declare -a sap_restricted_licenses=("LGPL" "GPL" "Affero%20GPL" "MPL" "CDDL" "EPL") + ret_val="" + issue_count=0 + for key in "${!sap_restricted_licenses[@]}"; do + api_resp=$(curl -X GET "https://api-sap.whitesourcesoftware.com/api/v2.0/projects/${PROJECT_TOKEN}/libraries/licenses?search=license%3Aequals%3A${sap_restricted_licenses[$key]}" \ + --header 'Content-Type: application/json' --silent \ + --header "Authorization: Bearer ${login_token}") + + api_resp_no=$(echo "${api_resp}" | jq .additionalData.totalItems ) + issue_count=$((issue_count+api_resp_no)) + + if [[ $api_resp_no -gt 0 ]] + then + val=$(echo "${api_resp}" | jq -r .retVal[] ) + ret_val="$ret_val$val" + fi + done + print "RESTRICTIED LICENSE FOR ON-PREMISE DELIVERY: ${issue_count}" + if [[ issue_count -gt 0 ]] + then + echo "${ret_val}" | jq . + fi + + return $issue_count + } + + print "HIGH/CRITICAL SECURITY VULNERABILITIES: ${security_vulnerability_no}" + if [[ $security_vulnerability_no -gt 0 ]] + then + echo "${security_vulnerability}" | jq -r .retVal[] + fi + + print "MAJOR UPDATES AVAILABLE: ${major_updates_pending_no}" + if [[ $major_updates_pending_no -gt 0 ]] + then + echo "${major_updates_pending}" | jq -r .retVal[] + fi + + print "LICENSE REQUIRES REVIEW: ${requires_review_no}" "Visit the Mend UI and add correct license" + if [[ $requires_review_no -gt 0 ]] + then + echo "${requires_review}" | jq -r .retVal[] + fi + + print "LICENSE RISK HIGH: ${high_license_risk_no}" + if [[ high_license_risk_no -gt 0 ]] + then + echo "Visit the Mend UI and check High Risk Licenses. Understand Risk Score: https://docs.mend.io/bundle/sca_user_guide/page/understanding_risk_score_attribution_and_license_analysis.html" + fi + + restricted_license + if [[ $security_vulnerability_no -gt 0 ]] || [[ $major_updates_pending_no -gt 0 ]] || [[ $requires_review_no -gt 0 ]] || [[ high_license_risk_no -gt 0 ]] || [[ violations -gt 0 ]] + then + exit 1 + fi