Source of https://glsec.github.io, the website and rule reference for glsec.
The rule pages are generated from docs/rules.md and docs/rules/GLxxx.md in the glsec repository, at the latest release tag, so the site always describes the version people can install. The OWASP page sorts the rules from that release's glsec list --format json into the ten OWASP CI/CD risks. The example on the home page and the example reports are the output of that release's binary on sample/bad-pipeline.yml, in every format. The GitLab example projects (gitlab.com/glsec-io/examples) scan the same file, and the screenshots on the reports page come from them, so keep the copies in sync.
The performance page charts data/benchmarks.jsonl from glsec's benchmarks branch, which glsec's benchmark history workflow writes for every change to main and once for every release; the tags mark the releases. perfStart in perf.go sets the first release it shows.
Needs Go, git, curl, jq and the GitHub CLI, logged in or with GH_TOKEN set.
./scripts/build.sh # writes _site/
python3 -m http.server -d _site 8000 # http://localhost:8000
go test ./...The build fails on a rule doc whose first line isn't # GLxxx — Title, on a relative link that leaves the glsec repository, and on any internal link without a page.
.github/workflows/deploy.yml publishes to GitHub Pages on every push to main, once a day, on workflow_dispatch and on a glsec-release repository dispatch.
To change rule text, edit the doc in glsec. It appears here with the next release.
Apache-2.0, like glsec.