diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml new file mode 100644 index 000000000..cd392e19c --- /dev/null +++ b/.github/linters/.checkov.yaml @@ -0,0 +1,9 @@ +skip-framework: + - cloudformation +skip-path: + - manifests + - load + - deploy + - x/webhook + - x/wire + - init_wait diff --git a/.github/linters/.gitleaks.toml b/.github/linters/.gitleaks.toml index 150012a93..9d0b308f0 100644 --- a/.github/linters/.gitleaks.toml +++ b/.github/linters/.gitleaks.toml @@ -1,169 +1,205 @@ - title = "gitleaks config" [[rules]] + id = "aws-access-key" description = "AWS Access Key" regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}''' tags = ["key", "AWS"] [[rules]] + id = "aws-secret-key" description = "AWS Secret Key" regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]''' tags = ["key", "AWS"] [[rules]] + id = "aws-mws-key" description = "AWS MWS key" regex = '''amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}''' tags = ["key", "AWS", "MWS"] [[rules]] + id = "facebook-secret-key" description = "Facebook Secret Key" regex = '''(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]''' tags = ["key", "Facebook"] [[rules]] + id = "facebook-client-id" description = "Facebook Client ID" regex = '''(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]''' tags = ["key", "Facebook"] [[rules]] + id = "twitter-secret-key" description = "Twitter Secret Key" regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}['\"]''' tags = ["key", "Twitter"] [[rules]] + id = "twitter-client-id" description = "Twitter Client ID" regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}['\"]''' tags = ["client", "Twitter"] [[rules]] + id = "github-pat" description = "Github Personal Access Token" regex = '''ghp_[0-9a-zA-Z]{36}''' tags = ["key", "Github"] + [[rules]] + id = "github-oauth" description = "Github OAuth Access Token" regex = '''gho_[0-9a-zA-Z]{36}''' tags = ["key", "Github"] + [[rules]] + id = "github-app-token" description = "Github App Token" regex = '''(ghu|ghs)_[0-9a-zA-Z]{36}''' tags = ["key", "Github"] + [[rules]] + id = "github-refresh-token" description = "Github Refresh Token" regex = '''ghr_[0-9a-zA-Z]{76}''' tags = ["key", "Github"] [[rules]] + id = "linkedin-client-id" description = "LinkedIn Client ID" regex = '''(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}''' tags = ["client", "LinkedIn"] [[rules]] + id = "linkedin-secret-key" description = "LinkedIn Secret Key" regex = '''(?i)linkedin(.{0,20})?[0-9a-z]{16}''' tags = ["secret", "LinkedIn"] [[rules]] + id = "slack-token" description = "Slack" regex = '''xox[baprs]-([0-9a-zA-Z]{10,48})?''' tags = ["key", "Slack"] [[rules]] + id = "asymmetric-private-key" description = "Asymmetric Private Key" regex = '''-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----''' tags = ["key", "AsymmetricPrivateKey"] [[rules]] + id = "google-api-key" description = "Google API key" regex = '''AIza[0-9A-Za-z\\-_]{35}''' tags = ["key", "Google"] [[rules]] + id = "gcp-service-account" description = "Google (GCP) Service Account" regex = '''"type": "service_account"''' tags = ["key", "Google"] [[rules]] + id = "heroku-api-key" description = "Heroku API key" regex = '''(?i)heroku(.{0,20})?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}''' tags = ["key", "Heroku"] [[rules]] + id = "mailchimp-api-key" description = "MailChimp API key" regex = '''(?i)(mailchimp|mc)(.{0,20})?[0-9a-f]{32}-us[0-9]{1,2}''' tags = ["key", "Mailchimp"] [[rules]] + id = "mailgun-api-key" description = "Mailgun API key" regex = '''((?i)(mailgun|mg)(.{0,20})?)?key-[0-9a-z]{32}''' tags = ["key", "Mailgun"] [[rules]] + id = "paypal-braintree-access-token" description = "PayPal Braintree access token" regex = '''access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}''' tags = ["key", "Paypal"] [[rules]] + id = "picatic-api-key" description = "Picatic API key" regex = '''sk_live_[0-9a-z]{32}''' tags = ["key", "Picatic"] [[rules]] + id = "sendgrid-api-key" description = "SendGrid API Key" regex = '''SG\.[\w_]{16,32}\.[\w_]{16,64}''' tags = ["key", "SendGrid"] [[rules]] + id = "slack-webhook" description = "Slack Webhook" regex = '''https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{24}''' tags = ["key", "slack"] [[rules]] + id = "stripe-api-key" description = "Stripe API key" regex = '''(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}''' tags = ["key", "Stripe"] [[rules]] + id = "square-access-token" description = "Square access token" regex = '''sq0atp-[0-9A-Za-z\-_]{22}''' tags = ["key", "square"] [[rules]] + id = "square-oauth-secret" description = "Square OAuth secret" regex = '''sq0csp-[0-9A-Za-z\\-_]{43}''' tags = ["key", "square"] [[rules]] + id = "twilio-api-key" description = "Twilio API key" regex = '''(?i)twilio(.{0,20})?SK[0-9a-f]{32}''' tags = ["key", "twilio"] [[rules]] + id = "dynatrace-token" description = "Dynatrace ttoken" regex = '''dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64}''' tags = ["key", "Dynatrace"] [[rules]] + id = "shopify-shared-secret" description = "Shopify shared secret" regex = '''shpss_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "shopify-access-token" description = "Shopify access token" regex = '''shpat_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "shopify-custom-app-access-token" description = "Shopify custom app access token" regex = '''shpca_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "shopify-private-app-access-token" description = "Shopify private app access token" regex = '''shppa_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "pypi-upload-token" description = "PyPI upload token" regex = '''pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000}''' tags = ["key", "pypi"] diff --git a/.github/linters/.golangci.yml b/.github/linters/.golangci.yml index 07cf99e49..5e10a88a4 100644 --- a/.github/linters/.golangci.yml +++ b/.github/linters/.golangci.yml @@ -1,52 +1,4 @@ ---- -######################### -######################### -## Golang Linter rules ## -######################### -######################### +version: "2" -# configure golangci-lint -# see https://github.com/golangci/golangci-lint/blob/master/.golangci.example.yml -run: - timeout: 10m issues: - exclude-rules: - - path: _test\.go - linters: - - dupl - - gosec - - goconst - - linters: - - revive - text: "var-naming: don't use leading k" - - linters: - - staticcheck - text: "SA1019:" -linters: - disable-all: true - enable: - - gosec - - unconvert - - goimports - - gofmt - - gocritic - - govet - - revive - - staticcheck - - unconvert - - unparam - - unused - - wastedassign - - whitespace -linters-settings: - errcheck: - # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`; - # default is false: such cases aren't reported by default. - check-blank: true - gocritic: - disabled-checks: - - singleCaseSwitch - - appendAssign - revive: - ignore-generated-header: true - severity: warning + new-from-rev: origin/main diff --git a/.github/linters/trivy.yaml b/.github/linters/trivy.yaml new file mode 100644 index 000000000..fc175b68b --- /dev/null +++ b/.github/linters/trivy.yaml @@ -0,0 +1,8 @@ +scan: + skip-dirs: + - manifests + - load + - deploy + - x/webhook + - x/wire + - init_wait diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index c230a47b0..83e5fcacc 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -7,15 +7,23 @@ on: pull_request: branches: [main] +permissions: {} + jobs: go: - uses: openconfig/common-ci/.github/workflows/go.yml@v0.2.0 + uses: openconfig/common-ci/.github/workflows/go.yml@abb79c974d34c0ec6cda3bcfcb2edb6679d197e1 # v0.3.0 + permissions: + contents: read + packages: read + statuses: write with: coverage-excludes-regex: /cloudbuild tests-excludes-regex: /cloudbuild race-tests-excludes-regex: /cloudbuild skip-race-tests: true - go-versions: "['1.21']" - linter: - uses: openconfig/common-ci/.github/workflows/linter.yml@v0.2.0 + lint: + uses: openconfig/common-ci/.github/workflows/linter.yml@abb79c974d34c0ec6cda3bcfcb2edb6679d197e1 # v0.3.0 + permissions: + contents: read + packages: read diff --git a/cloudbuild/kne_test.sh b/cloudbuild/kne_test.sh old mode 100644 new mode 100755 index 0b60645ed..66bbefe9e --- a/cloudbuild/kne_test.sh +++ b/cloudbuild/kne_test.sh @@ -19,7 +19,7 @@ export PATH=${PATH}:/usr/local/go/bin gopath=$(go env GOPATH) export PATH=${PATH}:$gopath/bin -# Replace exisiting kne repo with new version +# Replace existing kne repo with new version rm -r "$HOME/kne" cp -r /tmp/workspace "$HOME/kne" @@ -44,7 +44,7 @@ kubectl get pods -A $cli teardown kne/deploy/kne/kind-bridge.yaml # Create a kind cluster with GAR access and image loading -cat >/tmp/dep-cfg.yaml << EOF +cat >/tmp/dep-cfg.yaml <