**REMINDER****IMPORTANT** **ACTION REQUIRED** Migration of ubuntu-latest label to platform-eng-ent-v2-dual

.github/workflows/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - platform-eng-ent-v2-dual

.github/workflows/advisor.yml

@@ -0,0 +1,27 @@
+name: Permissions Advisor
+
+permissions:
+  actions: read
+
+on:
+  workflow_dispatch:
+    inputs:
+    #checkov:skip=CKV_GHA_7 allow user input for testing
+      name:
+        description: 'The name of the workflow file to analyze'
+        required: true
+        type: string
+      count:
+        description: 'How many last runs to analyze'
+        required: false
+        type: string
+        default: 10
+
+jobs:
+  advisor:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: GitHubSecurityLab/actions-permissions/advisor@v1
+      with:
+        name: ${{ inputs.name }}
+        count: ${{ inputs.count }}

.github/workflows/aqua-security.yaml

@@ -0,0 +1,174 @@
+name: 'Trivy Aqua Security Scan for Docker and ECR Reusable workflow'
+
+on:
+  workflow_call:
+    inputs:
+      docker_file:
+        description: Name of the dockerfile
+        type: string
+        default: ./Dockerfile
+        required: false
+      docker_tag_name:
+        description: Provide the docker tag names
+        type: string
+        default: ''
+        required: false
+      docker_file_context:
+        description: Docker File Context
+        type: string
+        default: .
+        required: false
+      docker_tag_version:
+         description: Provide the docker tag names
+         type: string
+         default: 'latest'
+         required: false
+      docker_build_args:
+        description: "Multi-Line list of build args with key value"
+        type: string
+        required: false
+        default: ''
+      ecr_image_name:
+        description: ECR repo image to scan
+        type: string
+        required: false
+      ecr_tag_version:
+        description: ECR repo tag version to scan
+        type: string
+        required: false
+        default: 'latest'
+      aws_account_id:
+        description: "AWS account ID"
+        type: string
+        required: false
+        default: ''
+      aws_account_region:
+        description: "AWS account region"
+        type: string
+        required: false
+        default: ''
+      aws_iam_role_arn:
+       description: "AWS ARN IAM Role"
+       type: string
+       required: false
+       default: ''
+      trivy_format:
+        description: "Trivy format to log out the scan"
+        type: string
+        default: 'table'
+        required: false
+      upload_to_codeql:
+        description: "Upload SARIF to CodeQL"
+        type: boolean
+        default: false
+        required: false
+      default_runner_override_label:
+        description: "Change this to 'self-hosted' or 'ubuntu-latest'"
+        type: string
+        default: "ubuntu-latest"
+        required: false
+      runner_label:
+        description: "Runner label to point to self hosted runners"
+        type: string
+        default: "ubuntu-latest"
+        required: false
+      scan_type:
+        description: "Scan Type to be scanned"
+        type: string
+        default: 'docker'
+        required: false
+      scan_reference:
+        description: "Scan reference(e.g. /github/workspace/ or .)"
+        type: string
+        default: "."
+        required: false
+      skip_directories:
+        description: "Comma separated list of directories where traversal is skipped"
+        type: string
+        default: ""
+        required: false
+    secrets:
+      OAUTH_TOKEN:
+        description: Github Token for accessing other dependency private repo
+        required: false
+
+jobs:
+  trivy-scan:
+    runs-on:
+    - ${{ inputs.default_runner_override_label }}
+    - ${{ inputs.runner_label }}
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set Variable
+      id: set-vars
+      run: |
+        if [ "${{ inputs.docker_tag_name }}" != "" ]; then
+          echo "file_output=trivy-results-docker.sarif" >> "$GITHUB_OUTPUT"
+        elif [ "${{ inputs.ecr_image_name }}" != "" ] &&  [ "${{ inputs.aws_account_id }}" != "" ]; then
+          echo "file_output=trivy-results-ecr.sarif" >> "$GITHUB_OUTPUT"
+        else
+          echo "file_output=trivy-results-fs.sarif" >> "$GITHUB_OUTPUT"
+        fi
+      shell: bash
+
+    - name: Configure aws credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-skip-session-tagging: true
+        role-to-assume: ${{ inputs.aws_iam_role_arn }}
+        role-session-name: gh-actions
+        aws-region: ${{ inputs.aws_account_region }}
+      if: ${{ (inputs.docker_tag_name =='') && (inputs.ecr_image_name !='') }}
+
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ inputs.aws_account_id }}.dkr.ecr.${{ inputs.aws_account_region }}.amazonaws.com/${{ inputs.ecr_image_name}}:${{ inputs.ecr_tag_version }}
+        format: ${{ inputs.trivy_format }}
+        output: ${{ inputs.upload_to_codeql && steps.set-vars.outputs.file_output || '' }}
+      if: ${{ (inputs.docker_tag_name =='') && (inputs.ecr_image_name !='') && (inputs.aws_account_id != '') }}
+
+    - name: Docker Build and Push
+      uses: docker/build-push-action@v6
+      with:
+        context: ${{ inputs.docker_file_context }}
+        file: ${{ inputs.docker_file }}
+        tags:  ${{ inputs.docker_tag_name }}:${{ inputs.docker_tag_version }}
+        build-args: |
+          GITHUB_OAUTH_TOKEN=${{ secrets.OAUTH_TOKEN }}
+          ${{ inputs.docker_build_args }}
+        push: false
+      if: ${{ inputs.docker_tag_name !='' }}
+
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: ${{ inputs.docker_tag_name }}:${{ inputs.docker_tag_version }}
+        format: ${{ inputs.trivy_format }}
+        output: ${{ inputs.upload_to_codeql && steps.set-vars.outputs.file_output || '' }}
+        ignore-unfixed: false
+        vuln-type: 'os,library'
+        severity: 'CRITICAL,HIGH,MEDIUM'
+      if: ${{ inputs.docker_tag_name !='' }}
+
+    - name: Run Trivy vulnerability scanner for Github Repo
+      uses: aquasecurity/trivy-action@master
+      with:
+        scan-type: 'fs'
+        scan-ref: ${{ inputs.scan_reference }}
+        ignore-unfixed: false
+        format: ${{ inputs.trivy_format }}
+        output: ${{ inputs.upload_to_codeql && steps.set-vars.outputs.file_output || '' }}
+        severity: 'HIGH,CRITICAL,MEDIUM'
+        skip-dirs: ${{ inputs.skip_directories }}
+      if: ${{ inputs.scan_type == 'fs' }}
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: ${{ steps.set-vars.outputs.file_output }}
+      if: ${{ inputs.upload_to_codeql }}

.github/workflows/autoupdate-pre-commit.yaml

@@ -0,0 +1,24 @@
+name: Pre-commit auto-update
+
+on:
+  # every sunday at midnight
+  schedule:
+    - cron: "0 0 * * 0"
+  # on demand
+  workflow_dispatch:
+
+# Request from Org admin to allow Github Action workflow to make PR under Settings > Actions > General
+permissions:
+  actions: read
+  checks: read
+  contents: write #require this to write to repo
+  pull-requests: write #require this to create PR
+
+jobs:
+  auto-update:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: SPHTech-Platform/gha-pre-commit-autoupdate@main
+        name: Update pre-commit config automatically
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/fortify-android.yaml

@@ -5,9 +5,12 @@ on:
       SSC_CI_TOKEN:
         description: 'CIToken for service account'
         required: true
-      PAT_TOKEN:
+      PACKAGE_READ_TOKEN:
         description: 'User PAT Token - to be removed'
         required: false
+      PACKAGE_READ_USERNAME:
+        description: 'User name of package user'
+        required: false
     inputs:
       APPLICATION:
         description: 'Application Name'
@@ -31,17 +34,25 @@ on:
         type: string
         required: false
         default: "app_bt"
+      default_runner_override_label:
+        description: Change this to "self-hosted" or "ubuntu-latest"
+        type: string
+        default: "ubuntu-latest"
+      runner_label:
+        description: Runner label to point to self hosted runners
+        type: string
+        default: "ubuntu-latest"
 
 jobs:
   FortifySourceAnalyzerAndroid:
     timeout-minutes: 120
     runs-on:
-    - self-hosted
-    - fortify-android
+    - ${{ inputs.default_runner_override_label }}
+    - ${{ inputs.runner_label }}
     steps:
       # Check out source code
       - name: Check Out Source Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Fetch at least the immediate parents so that if this is a pull request then we can checkout the head.
           fetch-depth: 2
@@ -56,15 +67,19 @@ jobs:
         run: |
            {
             echo "sdk.dir=/opt/android"
-            echo "GITHUB_USERNAME=$GITHUB_ACTOR"
-            echo "GITHUB_TOKEN=${{ secrets.PAT_TOKEN }}"
+            echo "GITHUB_TOKEN=${{ secrets.PACKAGE_READ_TOKEN }}"
+            echo "GITHUB_USERNAME=${{ secrets.PACKAGE_READ_USERNAME }}"
            } >> ./local.properties
            sourceanalyzer -b "$BUILD_ID" -clean
         env:
           BUILD_ID: ${{ inputs.BUILD_ID }}
           PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/opt/Fortify/bin/
           #  cat ./local.properties
 
+        #   Legacy reference
+        #   echo "GITHUB_USERNAME=$GITHUB_ACTOR"
+        #   echo "GITHUB_TOKEN=${{ secrets.PAT_TOKEN }}"
+
       ### Start Fortify Translation ###
       - name: Translate Code for Android Fortify Scan
         run: sourceanalyzer -b "$BUILD_ID" -gradle -verbose -debug -logfile "${BUILD_ID}_trans.log" ./gradlew ":${BUILD_PREFIX}:${BUILD_ID}" -Pdisable-plugins -x test -x lint
@@ -96,7 +111,7 @@ jobs:
 
       ### Clean up of build folder
       - name: Save sourceanalyzer Logs
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
            name: scancentral-logs

.github/workflows/fortify-sarif-export.yaml

@@ -41,13 +41,14 @@ jobs:
     steps:
       # Check out source code
       - name: Check Out Source Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Fetch at least the immediate parents so that if this is a pull request then we can checkout the head.
           fetch-depth: 2
       - name: Setup Java
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v4
         with:
+          distribution: zulu
           java-version: 11
       # Pull SAST issues from Fortify on Demand and generate GitHub-optimized SARIF output
       - name: Export Results

.github/workflows/fortify.yaml

@@ -54,7 +54,7 @@ jobs:
     steps:
       # Check out source code
       - name: Check Out Source Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Fetch at least the immediate parents so that if this is a pull request then we can checkout the head.
           fetch-depth: 2
@@ -66,8 +66,9 @@ jobs:
       # Java version to use depends on the Java version required to run your build (if any),
       # and the Java version supported by the ScanCentral Client version that you are running
       - name: Setup Java
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v4
         with:
+          distribution: zulu
           java-version: 11
 
       ### Set up Fortify ScanCentral Client ###
@@ -93,7 +94,7 @@ jobs:
 
       ### Archive ScanCentral Client logs on failure ###
       - name: Save ScanCentral Logs
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         if: failure()
         with:
            name: scancentral-logs