-
Notifications
You must be signed in to change notification settings - Fork 0
100 lines (90 loc) · 4.21 KB
/
devopsshield-docc-devops-shield.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
# Last applied at: Fri, 14 Feb 2025 14:04:15 GMT
# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
# https://devopsshield.com
##############################################################
# This is a DevOps Shield - Application Security - Code Security Template.
# This workflow template uses actions that are not certified by DevOps Shield.
# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
# Use this workflow template for integrating code security into your pipelines and workflows.
# DevOps Shield Workflow Template Details:
# ------------------------------------------------------------
# Code: GH_DOCC_DevOps_Shield
# Name: DevOps Shield Security Scanner
# DevSecOpsControls: DOCC
# Provider: DevOps Shield
# Categories: Other
# Description:
# DevOps Shield Security Scanner fills the gap between the DevSecOps and Cloud security governance solutions
# by hardening your Azure DevOps platform configuration and evaluating non-compliant DevOps resources.
# DevOps Shield Security Scanner
# An extension for Azure DevOps that adds a build task to run the DevOps Shield CLI
# Runs the DevOps Shield Docker container image
# Scans your Azure DevOps project and repository
# Evaluates 100+ DevOps Controls
# Exports the assessment results into SARIF and CSV formats
# For more information:
# https://marketplace.visualstudio.com/items?itemName=DevOpsShield.DevOpsShield-SecurityScanner
# https://hub.docker.com/r/devopsshield/devopsshield
# https://www.devopsshield.com/
# ------------------------------------------------------------
# Source repository: https://marketplace.visualstudio.com/items?itemName=DevOpsShield.DevOpsShield-SecurityScanner
##############################################################
name: DevOps Shield Security Scanner
on:
push:
branches: [master]
pull_request:
branches: [master]
jobs:
devopsshield:
runs-on: ubuntu-latest
permissions:
contents: read
# Write access for security-events is only required for customers looking for DevOps Shield results to appear in the codeQL security alerts tab on GitHub (Requires GHAS)
security-events: write
# You may want to provide an access token with permission to these scopes:
# repo(all)
# workflow
# read:packages
# read:org
# read:public_key
# read:repo_hook
# admin:org_hook
# notifications
# read:user
# user:email
# read:discussion
# read:enterprise
# read:audit_log
# read:network_configurations
# read:project
# read:gpg_key
# read:ssh_signing_key
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Run DevOps Shield Security Scanner
run: |
docker run --name devopsshield \
-v "${{ github.workspace }}:/devopsshield" \
--rm -t \
-e dosOrganizationName=${{ github.repository_owner }} \
-e dosPatToken=${{ secrets.PERSONAL_ACCESS_TOKEN_FOR_DEVOPS_SHIELD }} \
-e dosType=GitHub \
devopsshield/devopsshield
ls ${{ github.workspace }}
cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif
cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv
mkdir "${{ github.workspace }}/devops-shield-reports"
cp ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif "${{ github.workspace }}/devops-shield-reports"
cp ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv "${{ github.workspace }}/devops-shield-reports"
- name: Upload DevOps Shield Reports
uses: actions/upload-artifact@v4
with:
name: devops-shield-reports
path: "${{ github.workspace }}/devops-shield-reports"
# Upload alerts to the Security tab - required for DevOps Shield results to appear in the codeQL security alerts tab on GitHub (Requires GHAS)
- name: Upload results to Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif