diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 437bcd4b..a67b766f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,10 +5,12 @@ on: tags-ignore: - 'v*' branches: - - "**" + - "master" pull_request: - schedule: - - cron: '0 0 * * *' + workflow_call: + secrets: + GITLEAKS_LICENSE_KEY: + required: true concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} @@ -19,3 +21,7 @@ jobs: uses: smallstep/workflows/.github/workflows/goCI.yml@main with: os-dependencies: "libpcsclite-dev" + run-gitleaks: true + run-codeql: true + secrets: + GITLEAKS_LICENSE_KEY: ${{ secrets.GITLEAKS_LICENSE_KEY }} diff --git a/.github/workflows/code-scan-cron.yml b/.github/workflows/code-scan-cron.yml new file mode 100644 index 00000000..56969c11 --- /dev/null +++ b/.github/workflows/code-scan-cron.yml @@ -0,0 +1,9 @@ +on: + schedule: + - cron: '0 0 * * *' + +jobs: + code-scan: + uses: smallstep/workflows/.github/workflows/code-scan.yml@main + secrets: + GITLEAKS_LICENSE_KEY: ${{ secrets.GITLEAKS_LICENSE_KEY }} diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index f368d784..00000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null @@ -1,76 +0,0 @@ -# For most projects, this workflow file will not need changing; you simply need -# to commit it to your repository. -# -# You may wish to alter this file to override the set of languages analyzed, -# or to provide custom queries or build logic. -# -# ******** NOTE ******** -# We have attempted to detect the languages in your repository. Please check -# the `language` matrix defined below to confirm you have the correct set of -# supported CodeQL languages. -# -name: "CodeQL" - -on: - push: - branches: [ "master" ] - pull_request: - # The branches below must be a subset of the branches above - branches: [ "master" ] - schedule: - - cron: '0 0 * * *' - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -jobs: - analyze: - name: Analyze - runs-on: ubuntu-latest - permissions: - actions: read - contents: read - security-events: write - - strategy: - fail-fast: false - matrix: - language: [ 'go' ] - # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] - # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality - - - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 - - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5cea509d..bd434737 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,8 +8,8 @@ on: jobs: ci: - uses: smallstep/workflows/.github/workflows/goCI.yml@main - + uses: smallstep/certificates/.github/workflows/ci.yml@main + secrets: inherit create_release: name: Create Release diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 00000000..71318c8a --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,18 @@ +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:85 +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:107 +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:108 +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:129 +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:131 +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:136 +deac15327f5605a1a963e50818760a95cee9d882:docs/kms.md:generic-api-key:138 +7c9ab9814fb676cb3c125c3dac4893271f1b7ae5:README.md:generic-api-key:282 +fb7140444ac8f1fa1245a80e49d17e206f7435f3:docs/provisioners.md:generic-api-key:110 +e4de7f07e82118b3f926716666b620db058fa9f7:docs/revocation.md:generic-api-key:73 +e4de7f07e82118b3f926716666b620db058fa9f7:docs/revocation.md:generic-api-key:113 +e4de7f07e82118b3f926716666b620db058fa9f7:docs/revocation.md:generic-api-key:151 +8b2de42e9cf6ce99f53a5049881e1d6077d5d66e:docs/docker.md:generic-api-key:152 +3939e855264117e81531df777a642ea953d325a7:autocert/init/ca/intermediate_ca_key:private-key:1 +e72f08703753facfa05f2d8c68f9f6a3745824b8:README.md:generic-api-key:244 +e70a5dae7de0b6ca40a0393c09c28872d4cfa071:autocert/README.md:generic-api-key:365 +e70a5dae7de0b6ca40a0393c09c28872d4cfa071:autocert/README.md:generic-api-key:366 +c284a2c0ab1c571a46443104be38c873ef0c7c6d:config.json:generic-api-key:10