Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
130 commits
Select commit Hold shift + click to select a range
11bbdea
Add a security scanning workflow
Aug 25, 2025
865551f
Update workflow to run based on past workflow runs instead of past PRs
Aug 25, 2025
0713c16
Add a trigger to run the workflow every 5 mins
Aug 25, 2025
ed1576b
Update trigger
Aug 25, 2025
d656edd
Update trigger and API call
Aug 25, 2025
02d20e4
Remove automatic trigger for build action
Aug 25, 2025
00015d8
Add back workflow_dispatch trigger
Aug 25, 2025
9740ca1
Merge pull request #1 from sachinh-amazon/sachinh-testing
sachinh-amazon Aug 25, 2025
2875c1b
Fix quotes
Aug 25, 2025
462a3a1
Set the jq query correctly
Aug 25, 2025
7d60e7e
Fix JSON formatting
Aug 25, 2025
1527a98
Change schedule
Aug 25, 2025
88fc314
Reset the cron timer
Aug 25, 2025
bb80784
Add validation for base branch
Aug 25, 2025
e0acb29
Adjust environment variable for scanning
Aug 25, 2025
304c0c8
Add npm sbom step
Aug 25, 2025
0b5210b
Test PR
Aug 25, 2025
90ddec4
Add step to setup build env
Aug 25, 2025
49b1460
Merge branch 'main' into sachinh-test
Aug 25, 2025
7298d96
Only scan SageMaker server target for now
Aug 25, 2025
542e2e4
Merge branch 'main' into sachinh-test
Aug 25, 2025
e2ca107
Add recursive submodule checkout
Aug 25, 2025
f4fe653
Merge branch 'main' into sachinh-test
Aug 25, 2025
79b149c
Add step to setup Node JS
Aug 25, 2025
c889e97
Merge branch 'main' into sachinh-test
Aug 25, 2025
cccdac0
Install all packages that are required
Aug 25, 2025
c22b79c
Merge branch 'main' into sachinh-test
Aug 25, 2025
c11b626
Use CycloneDX
Aug 25, 2025
4bd03da
Merge branch 'main' into sachinh-test
Aug 25, 2025
478239e
Add AWS Integration
Aug 25, 2025
525ead6
Merge branch 'main' into sachinh-test
Aug 25, 2025
081cc71
Add result analysis for SBOM Scan
Aug 25, 2025
a8940e4
Merge branch 'main' into sachinh-test
Aug 25, 2025
63c1167
Change metric dimensions
Aug 25, 2025
a8c3c65
Add Security Scanning bash script
Aug 25, 2025
1d64d7d
Correct shebang
Aug 25, 2025
1e09d1e
Merge branch 'main' into sachinh-test
Aug 25, 2025
007e25c
Install tar-fs
Aug 25, 2025
5b0903c
Change order of outputting scan results
Aug 25, 2025
a57a4fa
Add scanned results directories
Aug 25, 2025
c83aabf
Correct metrics and functionality of the bash script
Aug 26, 2025
cc0e5f7
Correct metrics and adjust file upload
Aug 26, 2025
a783c0d
Merge branch 'main' into sachinh-test
Aug 26, 2025
04781cf
Adjust metrics and directories
Aug 26, 2025
f420cdf
Merge branch 'main' into sachinh-test
Aug 26, 2025
a350935
Fix scanning directories and commands
Aug 26, 2025
1e133fd
Merge branch 'main' into sachinh-test
Aug 26, 2025
a9c596c
Remove directory change
Aug 26, 2025
3dcae20
Merge branch 'main' into sachinh-test
Aug 26, 2025
13a25cd
Add echo for pwd and dir
Aug 26, 2025
9759ecc
Fix directories for security scanning
Aug 26, 2025
d530b8a
Remove GitSecrets scan on push since it will run on merge
Aug 26, 2025
942240d
Merge branch 'main' into sachinh-test
Aug 26, 2025
971d458
Re-arrange the workflows to get all branches first and then run the scan
Aug 26, 2025
bf61149
Add comment for manual trigger
Aug 26, 2025
c0b47e9
Merge branch 'main' into sachinh-test
Aug 26, 2025
21ca668
Change order for assuming AWS IAM Role
Aug 26, 2025
26d0d4a
Modify scan and adjust ignored errors directories
Aug 26, 2025
cbd8eec
Merge branch 'main' into sachinh-test
Aug 26, 2025
bd0e48d
Without tar-fs
Aug 26, 2025
343f46c
Add all targets to scan
Aug 26, 2025
a99b51d
Update the scanned results files
Aug 26, 2025
5a16e17
Merge branch 'main' into sachinh-test
Aug 26, 2025
0df86dd
Remove additional targets
Aug 26, 2025
bd3bcce
Merge branch 'main' into sachinh-test
Aug 26, 2025
504cf59
Pull script from main
Aug 26, 2025
5259b42
Replace build targets invocation trigger
Aug 26, 2025
723ad4f
Temporarily change trigger
Aug 26, 2025
882f407
Adjust trigger time and remove unused variable
Aug 26, 2025
a46a9d6
Merge branch 'aws:main' into main
sachinh-amazon Aug 26, 2025
a033ce5
Add scanning functionality to scan Node JS binaries
Aug 26, 2025
2947517
Merge branch 'main' into sachinh-test
Aug 26, 2025
ea49c7d
Remove the repository variable
Aug 26, 2025
425013c
Merge branch 'main' into sachinh-test
Aug 26, 2025
1e77797
Separate out a workflow for global dependency scanning
Aug 26, 2025
9ea3340
Merge branch 'main' into sachinh-test
Aug 26, 2025
3ae5ae3
Correct third party src directory
Aug 26, 2025
33aaf9d
Merge branch 'main' into sachinh-test
Aug 26, 2025
4754e5c
Change matrix branch and remove auto trigger for build workflow
Aug 26, 2025
b261540
Merge branch 'main' into sachinh-test
Aug 26, 2025
ed8b69c
Add GitHub scanning for Microsoft VS Code
Aug 26, 2025
c6d12ed
Merge branch 'main' into sachinh-test
Aug 26, 2025
a4800df
Add semver installation step
Aug 26, 2025
0722daf
Merge branch 'main' into sachinh-test
Aug 26, 2025
7c5c018
Add token for using GitHub CLI
Aug 26, 2025
b8225c8
Merge branch 'main' into sachinh-test
Aug 26, 2025
01fd0ef
Test intentional failure for GitHub scan
Aug 26, 2025
d04f467
Merge branch 'main' into sachinh-test
Aug 26, 2025
6201aac
Use semver range
Aug 26, 2025
873c203
Use semver --range
Aug 26, 2025
fc421ab
Merge branch 'main' into sachinh-test
Aug 26, 2025
ce49292
Update Github Scan Logic
Aug 26, 2025
184a424
Merge branch 'main' into sachinh-test
Aug 26, 2025
e7ddcd0
Use for loop for vulnerable versions
Aug 26, 2025
703c11f
Merge branch 'main' into sachinh-test
Aug 26, 2025
eb65452
Remove unused files
Aug 26, 2025
c7ef92d
Merge branch 'main' into sachinh-test
Aug 26, 2025
9569715
Add echo for incrementing count
Aug 26, 2025
57627c8
Merge branch 'main' into sachinh-test
Aug 26, 2025
22b96d8
Adjust severity to medium
Aug 26, 2025
ec87f5f
Merge branch 'main' into sachinh-test
Aug 26, 2025
f52d95e
Fix version
Aug 26, 2025
45ed35e
Merge branch 'main' into sachinh-test
Aug 26, 2025
d901ae7
Fix Node version detection
Aug 26, 2025
b0b26ac
Merge branch 'main' into sachinh-test
Aug 26, 2025
c3785e2
Sync with published PR
Aug 27, 2025
da0f43c
Merge branch 'aws:main' into main
sachinh-amazon Sep 1, 2025
50d62e4
Merge branch 'main' into sachinh-test
Sep 1, 2025
c7de554
Change trigger to 00:13 UTC for the security scan workflow
Sep 1, 2025
7f679bf
Add a test workflow
Sep 1, 2025
1f8502b
Change test workflow name
Sep 1, 2025
43b282c
Add TestWf
Sep 1, 2025
7e346ae
Remove TestWf
Sep 1, 2025
d7a8c1f
Modify the logic for checking previously scanned branches
Sep 1, 2025
6e97ca2
Update env variables
Sep 1, 2025
0655bfb
Correct context names
Sep 1, 2025
8874a29
Use databaseId, and the correct API to get artifacts
Sep 1, 2025
595f37e
Run security generate-security-scan-output on a matrix strategy
Sep 1, 2025
53eb8dc
Add validation for running security scan against empty branches
Sep 1, 2025
e388826
Update metrics and change from 24 hours to 2 hours ago for timing match
Sep 1, 2025
0230c12
Update check branch to PR base ref
Sep 1, 2025
9020969
Update security scanning workflow
Sep 1, 2025
db8b82a
Rename workflow
Sep 1, 2025
f4c75c2
Change workflow name
Sep 1, 2025
f152455
Merge branch 'main' into sachinh-test
sachinh-amazon Sep 1, 2025
e8ae7f2
Address PR comments
Sep 1, 2025
ba9743a
Use .packageversionrc file to refer to versions
Sep 1, 2025
9a6c3f0
Intentional failure
Sep 1, 2025
70ed16f
Intentional failure exit
Sep 1, 2025
a51a23f
Remove intention failure and restore previous day range
Sep 1, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions .github/workflows/build-targets.yaml
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
name: Build Code Editor Targets
on:
push:
branches:
- 'main'
- '*.*'
workflow_dispatch:

jobs:
build:
Expand Down
7 changes: 6 additions & 1 deletion .github/workflows/gitsecrets.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
name: GitSecretsScan

on: [push, pull_request]
on:
pull_request:
branches:
- main
- '*.*'
types: [opened, reopened, synchronize]

jobs:
git-secret-check:
Expand Down
566 changes: 566 additions & 0 deletions .github/workflows/security-scan.yml

Large diffs are not rendered by default.

37 changes: 37 additions & 0 deletions .github/workflows/test-workflow.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: TestWf

on:
workflow_dispatch:

jobs:
get-branches-to-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
run: |
echo "Hi!"

security-scan:
runs-on: ubuntu-latest
needs: [get-branches-to-scan]
strategy:
matrix:
target: [code-editor-sagemaker-server, code-editor-server]
steps:
- name: Assume IAM Role
run: |
sleep 5m
exit 1


security-scan-global-dependencies:
runs-on: ubuntu-latest
needs: [get-branches-to-scan]
strategy:
matrix:
target: [code-editor-sagemaker-server, code-editor-server]
steps:
- name: Assume IAM Role
run: |
echo "Exiting"
exit 1
2 changes: 2 additions & 0 deletions .packageversionrc
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
oss_attribution_generator_version=2.0.0
semver_version=7.7.2
10 changes: 8 additions & 2 deletions scripts/generate-oss-attribution.sh
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,10 @@ generate_oss_attribution() {
check_unapproved_licenses "$target" "$BUILD_SRC_DIR"
fi

npx --yes --package @electrovir/oss-attribution-generator@2.0.0 -- generate-attribution --baseDir "$BUILD_SRC_DIR" --outputDir "$oss_attribution_dir"
# Read OSS attribution generator version from packageversionrc
source "$ROOT_DIR/.packageversionrc"

npx --yes --package @electrovir/oss-attribution-generator@$oss_attribution_generator_version -- generate-attribution --baseDir "$BUILD_SRC_DIR" --outputDir "$oss_attribution_dir"
attribution_licenses=$(cat "$oss_attribution_dir/attribution.txt")

read_status=0
Expand Down Expand Up @@ -167,7 +170,10 @@ generate_unified_oss_attribution() {
echo "Generating unified OSS attribution for all targets"
mkdir -p "$BUILD_DIR/private/oss-attribution"

npx --yes --package @electrovir/oss-attribution-generator@2.0.0 -- generate-attribution \
# Read OSS attribution generator version from packageversionrc
source "$ROOT_DIR/.packageversionrc"

npx --yes --package @electrovir/oss-attribution-generator@$oss_attribution_generator_version -- generate-attribution \
-b "${target_dirs[0]}" "${target_dirs[1]}" "${target_dirs[2]}" "${target_dirs[3]}" \
--outputDir "$BUILD_DIR/private/oss-attribution"

Expand Down
Loading
Loading