Skip to content

Commit c7f349c

Browse files
mrfydamrfyda
committed
feature: Secret detection with Trivy
1 parent c935e02 commit c7f349c

15 files changed

+3077
-5
lines changed

‎.circleci/config.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
version: 2.1
2+
3+
orbs:
4+
codacy: codacy/[email protected]
5+
codacy_plugins_test: codacy/[email protected]
6+
7+
workflows:
8+
version: 2
9+
compile_test_deploy:
10+
jobs:
11+
- codacy/checkout_and_version
12+
- codacy/sbt:
13+
name: build_docker_and_test
14+
cmd: |
15+
# TODO: Ensure doc generation is done
16+
docker build -t $CIRCLE_PROJECT_REPONAME:latest .
17+
docker save --output docker-image.tar $CIRCLE_PROJECT_REPONAME:latest
18+
persist_to_workspace: true
19+
requires:
20+
- codacy/checkout_and_version
21+
- codacy_plugins_test/run:
22+
name: plugins_test
23+
run_multiple_tests: true
24+
requires:
25+
- build_docker_and_test
26+
- codacy/publish_docker:
27+
context: CodacyDocker
28+
requires:
29+
- plugins_test
30+
filters:
31+
branches:
32+
only:
33+
- master
34+
- codacy/tag_version:
35+
name: tag_version
36+
context: CodacyAWS
37+
requires:
38+
- codacy/publish_docker

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @codacy/toss

‎.gitignore

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.ammonite
2+
.mypy_cache
3+
*~
4+
.*.swp
5+
.idea
6+
.scala-build
7+
.bsp
8+
.metals
9+
.vscode
10+
project
11+
target

‎.scalafmt.conf

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version = "3.7.12"
2+
style = IntelliJ
3+
4+
runner.dialect = scala3
5+
6+
align.preset = none
7+
assumeStandardLibraryStripMargin = false
8+
binPack.literalArgumentLists = true
9+
binPack.parentConstructors = false
10+
continuationIndent.defnSite = 4
11+
danglingParentheses.preset = true
12+
docstrings.style = SpaceAsterisk
13+
includeCurlyBraceInSelectChains = true
14+
lineEndings = unix
15+
maxColumn = 120
16+
newlines.topLevelStatementBlankLines = [
17+
{
18+
blanks { before = 1 }
19+
}
20+
]
21+
newlines.penalizeSingleSelectMultiArgList = false
22+
newlines.sometimesBeforeColonInMethodReturnType = true
23+
optIn.breakChainOnFirstMethodDot = true
24+
project.git = true
25+
rewrite.rules = [ SortImports, PreferCurlyFors ]
26+
spaces.afterKeywordBeforeParen = true

‎Dockerfile

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
FROM golang:1.21-alpine as builder
2+
3+
WORKDIR /src
4+
5+
COPY go.mod .
6+
COPY go.sum .
7+
RUN go mod download
8+
9+
ADD . .
10+
RUN go build -o bin/codacy-trivy
11+
12+
FROM busybox
13+
14+
COPY --from=builder /src/bin /dist/bin
15+
COPY docs/ /docs/
16+
17+
RUN adduser -u 2004 -D docker
18+
RUN chown -R docker:docker /docs
19+
20+
CMD [ "/dist/bin/codacy-trivy" ]

‎LICENSE

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright 2023 Codacy.
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.

‎README.md

+55-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,58 @@
1-
# codacy-public-template
1+
# Codacy Trivy
22

3-
Template repository for new public repositories.
3+
This is the docker engine we use at Codacy to have [Trivy](https://github.com/aquasecurity/trivy) support.
44

5-
## GitHub actions
5+
## Usage
66

7-
This repository has the common GitHub actions that we want to have accross all of our public repositories.
8-
They should be kept at `.github/workflows`
7+
You can create the docker by doing:
8+
9+
```bash
10+
docker build -t codacy-trivy:latest .
11+
```
12+
13+
The docker is ran with the following command:
14+
15+
```bash
16+
docker run -it -v $srcDir:/src codacy-trivy:latest
17+
```
18+
19+
## Generate Docs
20+
21+
1. Update the version in `go.mod`
22+
2. Install the dependencies:
23+
24+
```bash
25+
go mod download
26+
```
27+
28+
3. Run the DocGenerator:
29+
30+
```bash
31+
go run ./doc-generator.go &&\
32+
scala-cli doc-generator.sc
33+
```
34+
35+
## Test
36+
37+
We use the [codacy-plugins-test](https://github.com/codacy/codacy-plugins-test) to test our external tools integration.
38+
You can follow the instructions there to make sure your tool is working as expected.
39+
40+
## What is Codacy?
41+
42+
[Codacy](https://www.codacy.com/) is an Automated Code Review Tool that monitors your technical debt, helps you improve your code quality, teaches best practices to your developers, and helps you save time in Code Reviews.
43+
44+
### Among Codacy’s features
45+
46+
- Identify new Static Analysis issues
47+
- Commit and Pull Request Analysis with GitHub, BitBucket/Stash, GitLab (and also direct git repositories)
48+
- Auto-comments on Commits and Pull Requests
49+
- Integrations with Slack, HipChat, Jira, YouTrack
50+
- Track issues in Code Style, Security, Error Proneness, Performance, Unused Code and other categories
51+
52+
Codacy also helps keep track of Code Coverage, Code Duplication, and Code Complexity.
53+
54+
Codacy supports PHP, Python, Ruby, Java, JavaScript, and Scala, among others.
55+
56+
### Free for Open Source
57+
58+
Codacy is free for Open Source projects.

‎docgenerator/doc-generator.sc

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
//> using scala "2"
2+
//> using lib "com.codacy::codacy-engine-scala-seed:6.1.0"
3+
//> using lib "com.lihaoyi::os-lib:0.9.1"
4+
//> using lib "com.lihaoyi::upickle:3.1.2"
5+
//> using lib "com.lihaoyi::requests:0.8.0"
6+
7+
import com.codacy.plugins.api.results.Pattern
8+
import com.codacy.plugins.api.results.Result
9+
import com.codacy.plugins.api.results.Tool
10+
11+
import com.codacy.plugins.api._
12+
import play.api.libs.json.Json
13+
14+
case class TrivySecretRule(ID: String, Category: String, Title: String, Severity: String)
15+
16+
implicit val trivySecretRuleRW = Json.format[TrivySecretRule]
17+
18+
val version = os
19+
.read(os.pwd / "go.mod")
20+
.linesIterator
21+
.collectFirst { case s" github.com/aquasecurity/trivy $version" =>
22+
version.trim
23+
}
24+
.get
25+
26+
val lines = os
27+
.proc("go", "run", "./docgenerator/extract-secret-rules.go")
28+
.call()
29+
.out
30+
.lines()
31+
.mkString
32+
33+
val trivyRules = Json.fromJson[List[TrivySecretRule]](Json.parse(lines)).asOpt.get
34+
35+
def categoryAndSubcategoryOf(patternId: String): (Pattern.Category, Option[Pattern.Subcategory]) =
36+
(Pattern.Category.Security, None)
37+
38+
def severityOf(rule: TrivySecretRule): Result.Level =
39+
rule.Severity match {
40+
case "CRITICAL" => Result.Level.Err
41+
case "HIGH" => Result.Level.Err
42+
case "MEDIUM" => Result.Level.Warn
43+
case "LOW" => Result.Level.Info
44+
case _ => Result.Level.Err
45+
}
46+
47+
val patternSpecifications = trivyRules.map { rule =>
48+
val (category, subcategory) = categoryAndSubcategoryOf(rule.ID)
49+
Pattern.Specification(Pattern.Id(rule.ID), severityOf(rule), category, subcategory, enabled = true)
50+
}
51+
52+
val patternDescriptions =
53+
trivyRules.map(rule => Pattern.Description(Pattern.Id(rule.ID), Pattern.Title(s"Detects ${rule.Title}"), None, None))
54+
55+
val specification = Tool.Specification(Tool.Name("trivy"), Some(Tool.Version(version)), patternSpecifications.toSet)
56+
57+
os.write.over(os.pwd / "docs" / "patterns.json", Json.prettyPrint(Json.toJson(specification)) + "\n")
58+
59+
os.remove.all(os.pwd / "docs" / "description")
60+
61+
os.write.over(
62+
os.pwd / "docs" / "description" / "description.json",
63+
Json.prettyPrint(Json.toJson(patternDescriptions)) + "\n",
64+
createFolders = true
65+
)

‎docgenerator/extract-secret-rules.go

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package main
2+
3+
import (
4+
"encoding/json"
5+
"fmt"
6+
7+
"github.com/aquasecurity/trivy/pkg/fanal/secret"
8+
)
9+
10+
func main() {
11+
12+
rules := secret.NewScanner(nil).Rules
13+
jsonResults, _ := json.Marshal(rules)
14+
fmt.Print(string(jsonResults))
15+
16+
}

0 commit comments

Comments
 (0)