Skip to content

Commit

Permalink
Add repository controls (#143)
Browse files Browse the repository at this point in the history
This PR adds two GH actions in order to comply with [Sourcegraph
Repository
Controls](https://www.notion.so/sourcegraph/Repository-policies-and-controls-0e9d5ae3ef4949b3bf0de48b247dc7d3):
- pr-auditor ensures that the PR has a Test Plan
- semgrep is our SAST tool

closes
https://linear.app/sourcegraph/issue/SEC-2167/review-vs-repo-controls
  • Loading branch information
andreeleuterio authored Dec 19, 2024
1 parent b0c232c commit 6c4d3ca
Show file tree
Hide file tree
Showing 3 changed files with 69 additions and 0 deletions.
5 changes: 5 additions & 0 deletions .github/PULL_REQUEST_TEMPLATE.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@


## Test plan

<!-- REQUIRED; info at https://docs-legacy.sourcegraph.com/dev/background-information/testing_principles -->
27 changes: 27 additions & 0 deletions .github/workflows/pr-auditor.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
name: pr-auditor
on:
pull_request_target:
types: [ closed, edited, opened, synchronize, ready_for_review ]


jobs:
check-pr:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
repository: 'sourcegraph/devx-service'
token: ${{ secrets.PR_AUDITOR_TOKEN }}
- uses: actions/setup-go@v4
with: { go-version: '1.22' }

- run: 'go run ./cmd/pr-auditor'
env:
GITHUB_EVENT_PATH: ${{ env.GITHUB_EVENT_PATH }}
GITHUB_TOKEN: ${{ secrets.PR_AUDITOR_TOKEN }}
GITHUB_RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
report_failure:
needs: check-pr
if: ${{ failure() }}
uses: sourcegraph/workflows/.github/workflows/report-job-failure.yml@main
secrets: inherit
37 changes: 37 additions & 0 deletions .github/workflows/semgrep.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: Semgrep - SAST Scan

on:
pull_request_target:
types: [ closed, edited, opened, synchronize, ready_for_review ]

jobs:
semgrep:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
container:
image: returntocorp/semgrep

steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}

- name: Checkout semgrep-rules repo
uses: actions/checkout@v4
with:
repository: sourcegraph/security-semgrep-rules
token: ${{ secrets.GH_SEMGREP_SAST_TOKEN }}
path: semgrep-rules

- name: Run Semgrep SAST Scan
run: |
mv semgrep-rules ../
semgrep ci -f ../semgrep-rules/semgrep-rules/ --metrics=off --oss-only --suppress-errors --sarif -o results.sarif --exclude='semgrep-rules' --baseline-commit "$(git merge-base main HEAD)" || true
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarif

0 comments on commit 6c4d3ca

Please sign in to comment.