From aa3c0a13373f7912f851e0619c4bba52394a5e5e Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Wed, 12 Nov 2025 13:02:33 +0100 Subject: [PATCH 1/2] added trivy --- .github/workflows/security.yml | 93 +++++++++++++++++++++++++++++++++- 1 file changed, 92 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index c9e1254..24e8e4b 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,4 +17,95 @@ jobs: name: Run Gitleaks Scan uses: peer-network/peer_global_security/.github/workflows/gitleaks.yml@main with: - config: gitleaks.toml \ No newline at end of file + config: gitleaks.toml + + trivy_scan: + name: Run Trivy Security Scan + needs: [gitleaks] + uses: peer-network/.github/.github/workflows/trivy-scan.yml@main + with: + scan_target: . + + map_pr_to_discord: + name: Map PR to Discord User + runs-on: ubuntu-latest + outputs: + discord_mention: ${{ steps.map.outputs.discord_mention }} + steps: + - id: map + run: | + case "${{ github.event.pull_request.user.login }}" in + WisdomNwaiwu) + echo "discord_mention=<@1362087975906967736>" >> $GITHUB_OUTPUT + ;; + jakobPeer) + echo "discord_mention=<@1334087880833892392>" >> $GITHUB_OUTPUT + ;; + devcrypt6) + echo "discord_mention=<@837718845330292766>" >> $GITHUB_OUTPUT + ;; + *) + echo "discord_mention=<@1362087975906967736>" >> $GITHUB_OUTPUT ;; + esac + + send_discord_notification: + name: Unified Discord Notification + runs-on: ubuntu-latest + needs: [gitleaks, trivy_scan, map_pr_to_discord] + if: always() + steps: + - name: Decide Notification Type + id: decide + run: | + gitleaks_result="${{ needs.gitleaks.result }}" + trivy_findings="${{ needs.trivy_scan.outputs.has_findings }}" + type="none" + if [ "$gitleaks_result" == "failure" ]; then + type="gitleaks_failed" + elif [ "$trivy_findings" == "true" ]; then + type="trivy_vulnerabilities" + else + type="success" + fi + echo "type=$type" >> $GITHUB_OUTPUT + + - name: Send Discord Notification + if: steps.decide.outputs.type != 'none' + env: + DISCORD_WEBHOOK_URL: ${{ secrets.RUST_DISCORD }} + DISCORD_MENTION: ${{ needs.map_pr_to_discord.outputs.discord_mention }} + PR_TITLE: ${{ github.event.pull_request.title }} + PR_URL: ${{ github.event.pull_request.html_url }} + RUN_URL: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} + run: | + case "${{ steps.decide.outputs.type }}" in + gitleaks_failed) + MESSAGE=":x: **Rust Backend Gitleaks Scan Failed!**\n" + MESSAGE+="**PR:** $PR_TITLE\n" + MESSAGE+="PR Link: <$PR_URL>\n" + MESSAGE+="CI Run: <$RUN_URL>\n" + MESSAGE+="Author: $DISCORD_MENTION\n\n" + MESSAGE+=":warning: **Secrets were detected by Gitleaks**\n" + MESSAGE+="You can:\n" + MESSAGE+="- [Click here to view workflow artifacts](<$RUN_URL>) (download the **gitleaks-report** artifact)\n" + MESSAGE+="- Check the **Actions → Artifacts** tab to view/download the report\n" + MESSAGE+=":no_entry: **Reminder:** Do NOT bypass with \`git commit --no-verify\`. CI will still block your PR.\n" + MESSAGE+="If this secret is actually required in the repo (false positive or approved usage),\n" + MESSAGE+="you MUST meet with the **CTO / Team Lead / DevOps** to approve and add it to the gitleaks ignore list." + ;; + trivy_vulnerabilities) + MESSAGE="**Trivy found HIGH or CRITICAL vulnerabilities!**\n" + MESSAGE+="**Do NOT ignore this finding — inform your Team Lead or CTO immediately.**\n" + MESSAGE+="View the **Trivy report artifact** in the Actions run for full details.\n" + MESSAGE+="**PR:** $PR_TITLE\n" + MESSAGE+="Link: <$PR_URL>\n" + MESSAGE+="Run: <$RUN_URL>\n" + MESSAGE+="Author: $DISCORD_MENTION\n\n" + MESSAGE+="<@837718845330292766> <@1362087975906967736> <@1334087880833892392>" + ;; + esac + + curl -H "Content-Type: application/json" \ + -X POST \ + -d "{\"content\": \"$MESSAGE\"}" \ + "$DISCORD_WEBHOOK_URL" \ No newline at end of file From e6b44a827a40153e76f4b8419c49387ccc5a43b9 Mon Sep 17 00:00:00 2001 From: WisdomNwaiwu Date: Wed, 12 Nov 2025 13:16:22 +0100 Subject: [PATCH 2/2] modified webhook name --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 24e8e4b..41e96d2 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -72,7 +72,7 @@ jobs: - name: Send Discord Notification if: steps.decide.outputs.type != 'none' env: - DISCORD_WEBHOOK_URL: ${{ secrets.RUST_DISCORD }} + DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }} DISCORD_MENTION: ${{ needs.map_pr_to_discord.outputs.discord_mention }} PR_TITLE: ${{ github.event.pull_request.title }} PR_URL: ${{ github.event.pull_request.html_url }}