Skip to content

Commit 9a0bd1d

Browse files
ayala-orcaayala-orca
authored
Update dependencies, add lint and unit-tests (#50)
1 parent 71210fd commit 9a0bd1d

File tree

14 files changed

+8037
-187
lines changed

14 files changed

+8037
-187
lines changed

‎.github/workflows/test-iac-action-sarif.yaml‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
permissions:
1414
security-events: write
1515
steps:
16-
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # ratchet:actions/checkout@v4
16+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4.2.2
1717
- name: Scan IaC
1818
id: orcasecurity_iac_scan
1919
uses: ./
@@ -25,12 +25,7 @@ jobs:
2525
output: "results/"
2626
console_output: "cli"
2727
- name: Upload SARIF file
28-
uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # ratchet:github/codeql-action/upload-sarif@v3
28+
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # ratchet:github/codeql-action/upload-sarif@v3.27.5
2929
if: ${{ always() && steps.orcasecurity_iac_scan.outputs.exit_code != 1 }}
3030
with:
3131
sarif_file: results/iac.sarif
32-
33-
34-
35-
36-

‎.github/workflows/test-iac-action.yaml‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
iac_scan_job:
1010
runs-on: ubuntu-latest
1111
steps:
12-
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # ratchet:actions/checkout@v4
12+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/checkout@v4.2.2
1313
- name: Scan IaC
1414
uses: ./
1515
with:
@@ -19,13 +19,8 @@ jobs:
1919
format: "json"
2020
output: "results/"
2121
console_output: "cli"
22-
- uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # ratchet:actions/upload-artifact@v4
22+
- uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # ratchet:actions/upload-artifact@v4.4.3
2323
if: always()
2424
with:
2525
name: orca-results
2626
path: results/
27-
28-
29-
30-
31-

‎.github/workflows/unit-tests.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Unit Tests
2+
on:
3+
pull_request:
4+
branches: [main]
5+
workflow_dispatch:
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
unit-tests:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/[email protected]
15+
16+
- name: Install dependencies
17+
run: npm install
18+
19+
- name: Run lint
20+
run: npm run lint
21+
22+
- name: Run tests
23+
run: npm test

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
11
# IDE
22
.idea
3-
node_modules
3+
node_modules
4+
5+
dist

‎README.md‎

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,13 @@ for [Orca Shift Left Security](https://orca.security/solutions/shift-left-securi
55

66
#### More info can be found in the official Orca Shift Left Security<a href="https://docs.orcasecurity.io/v1/docs/shift-left-security"> documentation</a>
77

8-
9-
108
## Table of Contents
119

12-
- [Orca Shift Left Security Action](#orca-shift-left-security-action)
13-
- [More info can be found in the official Orca Shift Left Security documentation](#more-info-can-be-found-in-the-official-orca-shift-left-security-documentation)
14-
- [Table of Contents](#table-of-contents)
15-
- [Usage](#usage)
16-
- [Workflow](#workflow)
17-
- [Inputs](#inputs)
18-
- [Annotations](#annotations)
19-
- [Upload SARIF report](#upload-sarif-report)
20-
10+
- [Usage](#usage)
11+
- [Workflow](#workflow)
12+
- [Inputs](#inputs)
13+
- [Annotations](#annotations)
14+
- [Upload SARIF report](#upload-sarif-report)
2115

2216
## Usage
2317

@@ -28,13 +22,13 @@ name: Sample Orca IaC Scan Workflow
2822
on:
2923
# Scan for each push event on your protected branch. If you have a different branch configured, please adjust the configuration accordingly by replacing 'main'.
3024
push:
31-
branches: [ "main" ]
25+
branches: ["main"]
3226
# NOTE: To enable scanning for pull requests, uncomment the section below.
3327
#pull_request:
34-
#branches: [ "main" ]
28+
#branches: [ "main" ]
3529
# NOTE: To schedule a daily scan at midnight, uncomment the section below.
3630
#schedule:
37-
#- cron: '0 0 * * *'
31+
#- cron: '0 0 * * *'
3832
jobs:
3933
orca-iac_scan:
4034
name: Orca IaC Scan
@@ -59,7 +53,7 @@ jobs:
5953
### Inputs
6054

6155
| Variable | Example Value &nbsp; | Description &nbsp; | Type | Required | Default |
62-
|--------------------------|--------------------------------------------|---------------------------------------------------------------------------------------------------------|---------|----------|-------------------------------|
56+
| ------------------------ | ------------------------------------------ | ------------------------------------------------------------------------------------------------------- | ------- | -------- | ----------------------------- |
6357
| api_token | | Orca API Token used for Authentication | String | Yes | N/A |
6458
| project_key | my-project-key | Project Key name | String | Yes | N/A |
6559
| path | terraform,sub-dir,other-sub-dir/Dockerfile | Paths or directories to scan (comma-separated) | String | Yes | N/A |
@@ -87,15 +81,18 @@ jobs:
8781
| log_path | results/ | The directory path to specify where the logs should be written to on debug mode. | String | No | working directory |
8882

8983
## Annotations
84+
9085
After scanning, the action will add the results as annotations in a pull request:
9186

9287
![](/assets/annotations_preview.png)
93-
> **NOTE:** Annotations can be disabled by setting the "show_annotation" input to "false"
9488

89+
> **NOTE:** Annotations can be disabled by setting the "show_annotation" input to "false"
9590
9691
## Upload SARIF report
92+
9793
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Orca Shift Left Security as a scanning tool
98-
> **NOTE:** Code scanning is available for all public repositories. Code scanning is also available in private repositories owned by organizations that use GitHub Enterprise Cloud and have a license for GitHub Advanced Security.
94+
95+
> **NOTE:** Code scanning is available for all public repositories. Code scanning is also available in private repositories owned by organizations that use GitHub Enterprise Cloud and have a license for GitHub Advanced Security.
9996
10097
Configuration:
10198

@@ -126,8 +123,7 @@ jobs:
126123
project_key: ${{ env.PROJECT_KEY }}
127124
path: <path to scan>
128125
format: "sarif"
129-
output:
130-
"results/"
126+
output: "results/"
131127
- name: Upload SARIF file
132128
uses: github/codeql-action/upload-sarif@v3
133129
if: ${{ always() && steps.orcasecurity_iac_scan.outputs.exit_code != 1 }}
@@ -139,6 +135,6 @@ The results list can be found on the security tab of your GitHub project and sho
139135
140136
![](/assets/code_scanning.png)
141137
142-
An entry should describe the error and in which line it occurred
138+
An entry should describe the error and in which line it occurred
143139
144140
![](/assets/code_scanning_alert.png)

‎SECURITY.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
1-
21
## Reporting a Vulnerability
32

4-
At Orca, we take security seriously and appreciate your help in disclosing any vulnerabilities responsibly and privately.
3+
At Orca, we take security seriously and appreciate your help in disclosing any vulnerabilities responsibly and privately.
54

65
To report a security issue, please email us at address `[email protected]`
76

87
---
8+
99
**Important:**
10-
1. Please **do not** create a Github issue for security vulnerabilities.
11-
2. Please **do not** disclose the vulnerability publicly until we have addressed it and provided guidance on the disclosure.
12-
3. Please include the following details in your report:
13-
- Description of the vulnerability
14-
- Steps to reproduce the vulnerability
15-
- Any additional information or context that might be helpful
10+
11+
1. Please **do not** create a Github issue for security vulnerabilities.
12+
2. Please **do not** disclose the vulnerability publicly until we have addressed it and provided guidance on the disclosure.
13+
3. Please include the following details in your report:
14+
- Description of the vulnerability
15+
- Steps to reproduce the vulnerability
16+
- Any additional information or context that might be helpful
17+
1618
---
1719

1820
> Submission of reports by any means is subject to Orca's [Vulnerability Disclosure Policy](https://trustcenter.orca.security/?itemUid=ff1626be-71c0-4468-b93c-82fe08aac01f&source=documents_card). Please make sure to read and accept before submitting your report.
19-

‎action.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,16 +27,6 @@ inputs:
2727
description: "Disable logs and warnings output"
2828
required: false
2929
default: "false"
30-
baseline_context_key:
31-
description: "Use this context key in case of no autodetect is configured on project"
32-
required: false
33-
disable_baseline:
34-
description: "Do not compare to baseline on this scan"
35-
required: false
36-
default: "false"
37-
sync_baseline:
38-
description: "Sync baseline base on this flag"
39-
required: false
4030
disable_err_report:
4131
description: "Suppress error reporting to the monitoring platform"
4232
required: false

‎entrypoint.sh‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -34,18 +34,9 @@ function set_global_flags() {
3434
if [ "${INPUT_CONFIG}" ]; then
3535
GLOBAL_FLAGS+=(--config "${INPUT_CONFIG}")
3636
fi
37-
if [ "${INPUT_BASELINE_CONTEXT_KEY}" ]; then
38-
GLOBAL_FLAGS+=(--baseline-context-key "${INPUT_BASELINE_CONTEXT_KEY}")
39-
fi
40-
if [ "${INPUT_DISABLE_BASELINE}" == "true" ]; then
41-
GLOBAL_FLAGS+=(--disable-baseline)
42-
fi
4337
if [ "${INPUT_DISABLE_ERR_REPORT}" == "true" ]; then
4438
GLOBAL_FLAGS+=(--disable-err-report)
4539
fi
46-
if [ "${INPUT_SYNC_BASELINE}" ]; then
47-
GLOBAL_FLAGS+=(--sync-baseline "${INPUT_SYNC_BASELINE}")
48-
fi
4940
if [ "${INPUT_DISPLAY_NAME}" ]; then
5041
GLOBAL_FLAGS+=(--display-name "${INPUT_DISPLAY_NAME}")
5142
fi
@@ -102,7 +93,7 @@ function set_iac_scan_flags() {
10293
SCAN_FLAGS+=(--exclude-platform "${INPUT_EXCLUDE_PLATFORM}")
10394
fi
10495
if [ "${INPUT_CONTROL_TIMEOUT}" ]; then
105-
SCAN_FLAGS+=(--control_timeout "${INPUT_CONTROL_TIMEOUT}")
96+
SCAN_FLAGS+=(--control-timeout "${INPUT_CONTROL_TIMEOUT}")
10697
fi
10798
if [ "${INPUT_TIMEOUT}" ]; then
10899
SCAN_FLAGS+=(--timeout "${INPUT_TIMEOUT}")

‎eslint.config.js‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
const js = require("@eslint/js");
2+
3+
module.exports = [
4+
{
5+
// Global ignores
6+
ignores: ["dist/**"],
7+
},
8+
{
9+
// Base configuration
10+
files: ["**/*.{js}"],
11+
settings: {
12+
"import/resolver": {
13+
typescript: {},
14+
},
15+
},
16+
rules: {
17+
...js.configs.recommended.rules,
18+
19+
// Spacing and formatting rules
20+
"space-before-blocks": "error",
21+
"keyword-spacing": "error",
22+
"no-trailing-spaces": "error",
23+
curly: "error",
24+
quotes: ["error", "single"],
25+
"object-curly-spacing": ["error", "always"],
26+
"no-multi-spaces": "error",
27+
"semi-spacing": "error",
28+
29+
// Code style rules
30+
"prefer-const": ["error", { destructuring: "all" }],
31+
"max-classes-per-file": ["error", 10],
32+
"max-len": ["error", 200],
33+
34+
// Import rules
35+
"import/no-unresolved": [
36+
"error",
37+
{ commonjs: true, caseSensitive: true },
38+
],
39+
"import/extensions": ["error", "ignorePackages", { js: "never" }],
40+
},
41+
},
42+
{
43+
// Test files override
44+
files: ["**/test/**"],
45+
rules: {
46+
"import/no-unresolved": "off",
47+
"import/extensions": "off",
48+
},
49+
},
50+
];

0 commit comments

Comments
 (0)