gitlab-ci-python-defectdojo/.gitlab-ci.yml at main · appsecengineer/gitlab-ci-python-defectdojo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
stages:
  - sast
  - secrets

sast_scan:
  image: docker:stable
  stage: sast
  allow_failure: true
  variables:
    DOCKER_DRIVER: overlay2
  services:
    - docker:stable-dind
  script:
    - apk add py-pip curl
    - pip install bandit
    - bandit -r -f json -o bandit_result.json --exit-zero app/
    - |
      curl -X 'POST' \
        'http://<your-instance-server-ip>:8080/api/v2/reimport-scan/' \
        -H 'accept: application/json' \
        -H 'Authorization: Token <your-instance-api-token>' \
        -H 'Content-Type: multipart/form-data' \
        -F 'test=<your-instance-test-id>' \
        -F '[email protected];type=application/json' \
        -F file=@"bandit_result.json" \
        -F 'scan_type=Bandit Scan' \
        -F 'tags=test'
  artifacts:
    paths: [bandit_result.json]
    expire_in: 1 week

semgrep:
  image: returntocorp/semgrep-agent:v1
  stage: sast
  allow_failure: true
  script:
    - apk add py-pip curl
    - pip install semgrep
    - semgrep scan . --config auto --json >> semgrep_result.json
    - |
      curl -X 'POST' \
        'http://<your-instance-server-ip>:8080/api/v2/reimport-scan/' \
        -H 'accept: application/json' \
        -H 'Authorization: Token <your-instance-api-token>' \
        -H 'Content-Type: multipart/form-data' \
        -F 'test=<your-instance-test-id>' \
        -F '[email protected];type=application/json' \
        -F file=@"semgrep_result.json" \
        -F 'scan_type=Semgrep JSON Report' \
        -F 'tags=test'
  artifacts:
    paths: [semgrep_result.json]
    expire_in: 1 week

gitleaks:
  image: docker:stable
  stage: secrets
  allow_failure: true
  variables:
    DOCKER_DRIVER: overlay2
  services:
    - docker:dind
  script:
    - apk add py-pip curl
    - docker run --rm --name=gitleaks -v $PWD/:/code zricethezav/gitleaks  detect  --source /code --report-path /code/gitleaks.json || true
    - |
      curl -X 'POST' \
        'http://<your-instance-server-ip>:8080/api/v2/reimport-scan/' \
        -H 'accept: application/json' \
        -H 'Authorization: Token <your-instance-api-token>' \
        -H 'Content-Type: multipart/form-data' \
        -F 'test=<your-instance-test-id>' \
        -F '[email protected];type=application/json' \
        -F file=@"gitleaks.json" \
        -F 'scan_type=Gitleaks Scan' \
        -F 'tags=test'
  artifacts:
    paths: [gitleaks.json]
    expire_in: 1 week