java-github-actions-demo/.github/workflows/nightvision-slack.yml at main · alexcoderabbitai/java-github-actions-demo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: Test Case - Slack - Java Spring App

on:
#  push:
  workflow_dispatch:

env:
  NIGHTVISION_TOKEN: ${{ secrets.NIGHTVISION_TOKEN }}
  NIGHTVISION_TARGET: javaspringvulny-api
  NIGHTVISION_APP: javaspringvulny-api
  NIGHTVISION_AUTH: javaspringvulny-api
  SLACK_TOKEN: ${{ secrets.SLACK_TOKEN }}
  SLACK_CHANNEL_ID: ${{ secrets.SLACK_CHANNEL_ID }}

jobs:
  test:
    permissions:
      security-events: write
    runs-on: ubuntu-latest
    steps:
      - name: (1) Clone Code
        uses: actions/checkout@v3

      - name: (2) Install NightVision
        run: |
          wget -c https://downloads.nightvision.net/binaries/latest/nightvision_latest_linux_amd64.tar.gz -O - | tar -xz
          sudo mv nightvision /usr/local/bin/
          python -m pip install semgrep --user

      - name: (3) Extract API documentation from code
        run: |
          nightvision swagger extract ./ -t ${{ env.NIGHTVISION_TARGET }} --lang spring || true
          if [ ! -e openapi-spec.yml ]; then
              cp backup-openapi-spec.yml openapi-spec.yml
          fi

      - name: (4) Start the app
        run: |
          docker-compose up -d
          sleep 10

      - name: (5) Scan the API
        run: |
          nightvision scan ${{ env.NIGHTVISION_TARGET }} -a ${{ env.NIGHTVISION_APP }} --auth ${{ env.NIGHTVISION_AUTH }} > scan-results.txt
          nightvision export sarif -s "$(head -n 1 scan-results.txt)" --swagger-file openapi-spec.yml

      - name: (6) Upload SARIF file to GitHub Security Alerts if vulnerabilities are found
        uses: github/codeql-action/upload-sarif@v2
        if: success()
        with:
          sarif_file: results.sarif

      - name: (7) Install nightvision slack importer and dependencies
        run: |
          git clone https://github.com/jxbt/nightvision_slack_importer.git
          cd nightvision_slack_importer
          chmod +x install.sh && sudo ./install.sh
          python3 -m venv .venv
          source .venv/bin/activate
          pip3 install -r requirements.txt

      - name: (8) Run NightVision Slack Importer
        run: |
          cd nightvision_slack_importer
          source .venv/bin/activate
          python3 nightvision_slack_importer.py --sarif ../results.sarif --token ${{ env.SLACK_TOKEN }} --channel ${{ env.SLACK_CHANNEL_ID }}