Skip to content

Commit 6f9217c

Browse files
author
thyldrm
committed
first commit
0 parents  commit 6f9217c

File tree

19 files changed

+45542
-0
lines changed

19 files changed

+45542
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: CI
2+
on:
3+
push:
4+
branches: [main, develop]
5+
pull_request:
6+
branches: [main]
7+
8+
jobs:
9+
test:
10+
name: Test Action
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout
15+
uses: actions/checkout@v4
16+
17+
- name: Setup Node.js
18+
uses: actions/setup-node@v4
19+
with:
20+
node-version: '20'
21+
cache: 'npm'
22+
23+
- name: Install Dependencies
24+
run: npm ci
25+
26+
- name: Lint
27+
run: npm run lint
28+
29+
- name: Type Check
30+
run: npx tsc --noEmit
31+
32+
- name: Test
33+
run: npm test
34+
35+
- name: Build
36+
run: npm run build
37+
38+
- name: Check Build Output
39+
run: |
40+
if [ ! -f "dist/index.js" ]; then
41+
echo "Build failed - dist/index.js not found"
42+
exit 1
43+
fi
44+
echo "✅ Build successful - dist/index.js created"
45+
46+
test-action:
47+
name: Test Action Integration
48+
runs-on: ubuntu-latest
49+
needs: test
50+
if: github.event_name == 'pull_request'
51+
52+
steps:
53+
- name: Checkout
54+
uses: actions/checkout@v4
55+
56+
- name: Test CodeThreat Action (Dry Run)
57+
uses: ./
58+
with:
59+
api-key: 'test-key'
60+
wait-for-completion: false
61+
upload-sarif: false
62+
verbose: true
63+
continue-on-error: true # Expected to fail with test key
64+
65+
package:
66+
name: Package Release
67+
runs-on: ubuntu-latest
68+
needs: test
69+
if: github.ref == 'refs/heads/main'
70+
71+
steps:
72+
- name: Checkout
73+
uses: actions/checkout@v4
74+
75+
- name: Setup Node.js
76+
uses: actions/setup-node@v4
77+
with:
78+
node-version: '20'
79+
cache: 'npm'
80+
81+
- name: Install Dependencies
82+
run: npm ci
83+
84+
- name: Build for Release
85+
run: npm run package
86+
87+
- name: Commit Built Files
88+
run: |
89+
git config --local user.email "action@github.com"
90+
git config --local user.name "GitHub Action"
91+
git add dist/
92+
git diff --staged --quiet || git commit -m "Update built action [skip ci]"
93+
git push

‎.gitignore‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Dependencies
2+
node_modules/
3+
npm-debug.log*
4+
5+
# Build outputs
6+
lib/
7+
*.tsbuildinfo
8+
# Note: dist/ is intentionally NOT ignored for GitHub Actions
9+
10+
# IDE
11+
.vscode/
12+
.idea/
13+
14+
# OS
15+
.DS_Store
16+
Thumbs.db
17+
18+
# Logs
19+
*.log
20+
21+
# Test coverage
22+
coverage/
23+
24+
# GitHub Action artifacts
25+
licenses.txt
26+
27+
# Environment
28+
.env
29+
.env.local

‎CHANGELOG.md‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Changelog
2+
3+
All notable changes to the CodeThreat GitHub Action will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [1.0.0] - 2024-01-XX
9+
10+
### Added
11+
12+
#### Core Functionality
13+
- **Security Scanning**: Comprehensive SAST, SCA, Secrets, and IaC analysis
14+
- **GitHub Integration**: Automatic SARIF upload to GitHub Security tab
15+
- **Synchronous Execution**: Real-time scan execution with progress monitoring
16+
- **Multiple Output Formats**: Support for SARIF, JSON, XML, CSV, and JUnit formats
17+
18+
#### Action Features
19+
- **Flexible Configuration**: 20+ input parameters for customization
20+
- **Build Protection**: Configurable failure conditions (critical, high, max violations)
21+
- **Repository Management**: Automatic repository import and detection
22+
- **Comprehensive Logging**: Structured logging with debug mode support
23+
24+
#### CI/CD Integration
25+
- **GitHub Security Tab**: Automatic SARIF upload and vulnerability display
26+
- **Workflow Integration**: Seamless integration with existing GitHub workflows
27+
- **Output Variables**: Rich set of outputs for downstream workflow steps
28+
- **Error Handling**: Graceful error handling with actionable error messages
29+
30+
#### Developer Experience
31+
- **TypeScript**: Fully typed codebase for better development experience
32+
- **Modular Design**: Clean separation of concerns with dedicated modules
33+
- **Comprehensive Documentation**: Detailed README with examples
34+
- **Professional Testing**: Jest test suite with CI/CD validation
35+
36+
### Technical Details
37+
38+
#### Architecture
39+
- **Modular Design**: Separate modules for inputs, outputs, API client, and SARIF upload
40+
- **Error Boundaries**: Comprehensive error handling at each step
41+
- **GitHub Actions Best Practices**: Follows official GitHub Actions guidelines
42+
- **Security First**: Secure handling of API keys and sensitive data
43+
44+
#### API Integration
45+
- **CodeThreat API Client**: Robust HTTP client with retry logic and error handling
46+
- **Authentication**: Secure API key authentication with validation
47+
- **Real-time Monitoring**: Polling-based scan status monitoring
48+
- **Result Processing**: Multi-format result export and processing
49+
50+
#### GitHub Integration
51+
- **SARIF 2.1.0**: Full compliance with SARIF specification
52+
- **Code Scanning API**: Integration with GitHub's Code Scanning API
53+
- **Security Tab**: Automatic vulnerability display in GitHub UI
54+
- **Permissions**: Proper permission handling for security events
55+
56+
### Dependencies
57+
58+
#### Production Dependencies
59+
- `@actions/core`: ^1.10.1 - GitHub Actions core functionality
60+
- `@actions/github`: ^6.0.0 - GitHub API integration
61+
- `@actions/exec`: ^1.1.1 - Command execution utilities
62+
- `@actions/tool-cache`: ^2.0.1 - Tool caching functionality
63+
- `axios`: ^1.6.2 - HTTP client for API communication
64+
- `fs-extra`: ^11.2.0 - Enhanced file system operations
65+
66+
#### Development Dependencies
67+
- `@vercel/ncc`: ^0.38.1 - Action bundling and compilation
68+
- `typescript`: ^5.3.3 - TypeScript compiler
69+
- `eslint`: ^8.55.0 - Code linting
70+
- `jest`: ^29.7.0 - Testing framework
71+
72+
### Breaking Changes
73+
- None (initial release)
74+
75+
### Migration Guide
76+
- None (initial release)
77+
78+
---
79+
80+
## Release Notes Template
81+
82+
When releasing new versions, use this template:
83+
84+
### [X.Y.Z] - YYYY-MM-DD
85+
86+
#### Added
87+
- New features and capabilities
88+
89+
#### Changed
90+
- Changes to existing functionality
91+
92+
#### Deprecated
93+
- Features that will be removed in future versions
94+
95+
#### Removed
96+
- Features that have been removed
97+
98+
#### Fixed
99+
- Bug fixes and corrections
100+
101+
#### Security
102+
- Security-related changes and fixes

0 commit comments

Comments
 (0)