Skip to content
This repository was archived by the owner on May 9, 2025. It is now read-only.

Commit 0e6cac5

Browse files
shivenduverma-sapshivenduverma-sap
authored
Merge pull request #84 from open-component-model/feature/test-mend
Add Reports to Mend Scans
2 parents c689660 + 397d73f commit 0e6cac5

File tree

2 files changed

+171
-10
lines changed

2 files changed

+171
-10
lines changed

‎.github/workflows/mend.config‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# WhiteSource Unified-Agent configuration file for GO
33
# GENERAL SCAN MODE: Package Managers only
44
####################################################################
5+
#Configuration Reference: https://docs.mend.io/bundle/unified_agent/page/unified_agent_configuration_parameters.html#General
56

67
# !!! Important for WhiteSource "DIST - *" Products:
78
# Please set
@@ -21,33 +22,37 @@ failErrorLevel=ALL
2122
# failBuildOnPolicyViolation:
2223
# If the flag is true, the Unified Agent exit code will be the result of the policy check.
2324
# If the flag is false, the Unified Agent exit code will be the result of the scan.
24-
forceUpdate.failBuildOnPolicyViolation=false
25+
forceUpdate.failBuildOnPolicyViolation=true
2526
# offline parameter is important and need to be false
2627
offline=false
2728

2829
# ignoreSourceFiles parameter is important and need to be true
2930
# IMPORTANT: This parameter is going to be deprecated in future
3031
# and will be replaced by a new parameter, fileSystemScan.
31-
ignoreSourceFiles=true
32+
# ignoreSourceFiles=true
3233
# fileSystemScan parameter is important and need to be false as a
3334
# replacement for ignoreSourceFiles=true and overrides the
34-
# soon-to-be-deprecated ignoreSourceFiles.
35-
fileSystemScan=false
35+
# soon-to-be-deprecated ignoreSourceFiles. To scan source files, we need to enable it.
36+
fileSystemScan=true
3637
# resolveAllDependencies is important and need to be false
3738
resolveAllDependencies=false
3839

3940
#wss.connectionTimeoutMinutes=60
4041
# URL to your WhiteSource server.
4142
# wss.url=https://sap.whitesourcesoftware.com/agent
43+
44+
####################################################################
45+
# GO Configuration
46+
####################################################################
4247

4348
# resolveDependencies parameter is important and need to be true
4449
#if you are using 'modules' as a dependency manager, then the go.resolveDependencies is set to false.
4550
#For any other dependency manager, this value is set to true.
4651

4752
go.resolveDependencies=true
4853
#defaut value for ignoreSourceFiles is set to false
49-
# ignoreSourceFiles parameter is important and need to be true
50-
go.ignoreSourceFiles=true
54+
# ignoreSourceFiles parameter is important and need to be true #To scan source files, we need to disable it.
55+
go.ignoreSourceFiles=false
5156
go.collectDependenciesAtRuntime=false
5257
# dependencyManager: Determines the Go dependency manager to use when scanning a Go project.
5358
# Valid values are 'dep', 'godep', 'vndr', 'gogradle', 'glide', 'govendor', 'gopm' and 'vgo'
@@ -61,12 +66,13 @@ go.collectDependenciesAtRuntime=false
6166
#Please comment these below 4 lines that has 'go.modules' prefix if you are not using the 'modules' dependency manager.
6267
# Default value is true. If set to true, it resolves Go Modules dependencies.
6368
go.modules.resolveDependencies=true
64-
#default value is true. If set to true, this will ignore Go source files during the scan.
65-
#go.modules.ignoreSourceFiles=true
69+
#default value is true. If set to true, this will ignore Go source files during the scan.
70+
#To scan source files, we need to disable it.
71+
go.modules.ignoreSourceFiles=false
6672
#default value is true. If set to true, removes duplicate dependencies during Go Modules dependency resolution.
6773
#go.modules.removeDuplicateDependencies=false
6874
#default value is false. if set to true, scans Go Modules project test dependencies.
69-
#go.modules.includeTestDependencies=true
75+
go.modules.includeTestDependencies=true
7076
######################
7177

7278

‎.github/workflows/mend_scan.yaml‎

Lines changed: 156 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,29 @@ name: Mend Security Scan
33
on:
44
schedule:
55
- cron: '10 0 * * 0'
6+
push:
7+
branches:
8+
- main
9+
pull_request:
10+
branches:
11+
- main
12+
workflow_dispatch:
13+
inputs:
14+
logLevel:
15+
description: 'Log level'
16+
required: true
17+
default: 'debug'
18+
type: choice
19+
options:
20+
- info
21+
- warning
22+
- debug
623

724
jobs:
825
mend-scan:
926
runs-on: ubuntu-latest
10-
27+
permissions:
28+
pull-requests: write
1129
steps:
1230
- name: Checkout Code
1331
uses: actions/checkout@v4
@@ -23,6 +41,11 @@ jobs:
2341
with:
2442
go-version-file: '${{ github.workspace }}/go.mod'
2543

44+
- name: 'Setup jq'
45+
uses: dcarbone/[email protected]
46+
with:
47+
version: '1.7'
48+
2649
- name: Download Mend Universal Agent
2750
run: curl https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar -o ./wss-unified-agent.jar
2851

@@ -34,4 +57,136 @@ jobs:
3457
WSS_URL: ${{ secrets.MEND_URL }}
3558
API_KEY: ${{ secrets.MEND_API_TOKEN }}
3659
CONFIG_FILE: './.github/workflows/mend.config'
60+
61+
- name: Generate Report
62+
env:
63+
USER_KEY: ${{ secrets.MEND_API_USER_KEY }}
64+
PROJECT_TOKEN: ${{ secrets.MEND_PROJECT_TOKEN_GIT_CONTR }}
65+
API_KEY: ${{ secrets.MEND_API_ORG_TOKEN }}
66+
EMAIL: ${{ secrets.MEND_API_EMAIL }}
67+
id: report
68+
run: |
69+
data=$(cat <<EOF
70+
{
71+
"email": "${EMAIL}",
72+
"orgToken": "${API_KEY}",
73+
"userKey": "${USER_KEY}"
74+
}
75+
EOF
76+
)
77+
78+
login_token=$(curl -X POST 'https://api-sap.whitesourcesoftware.com/api/v2.0/login' \
79+
--header 'Content-Type: application/json' --silent \
80+
--data "${data}" | jq -r .retVal.jwtToken )
81+
82+
security_vulnerability=$(curl -X GET "https://api-sap.whitesourcesoftware.com/api/v2.0/projects/${PROJECT_TOKEN}/alerts/security?search=status%3Aequals%3AACTIVE%3Bscore%3Abetween%3A6%2C10%3B" \
83+
--header 'Content-Type: application/json' --silent \
84+
--header "Authorization: Bearer ${login_token}")
85+
86+
major_updates_pending=$(curl -X GET "https://api-sap.whitesourcesoftware.com/api/v2.0/projects/${PROJECT_TOKEN}/alerts/legal?search=status%3Aequals%3AACTIVE%3BavailableVersionType%3Aequals%3AMAJOR" \
87+
--header 'Content-Type: application/json' --silent \
88+
--header "Authorization: Bearer ${login_token}" )
89+
90+
requires_review=$(curl -X GET "https://api-sap.whitesourcesoftware.com/api/v2.0/projects/${PROJECT_TOKEN}/libraries/licenses?search=license%3Aequals%3ARequires%20Review" \
91+
--header 'Content-Type: application/json' --silent \
92+
--header "Authorization: Bearer ${login_token}")
93+
94+
high_license_risk=$(curl -X GET "https://api-sap.whitesourcesoftware.com/api/v2.0/projects/${PROJECT_TOKEN}/libraries/licenses?pageSize=1000" \
95+
--header 'Content-Type: application/json' --silent \
96+
--header "Authorization: Bearer ${login_token}")
97+
98+
security_vulnerability_no=$(echo "${security_vulnerability}" | jq .additionalData.totalItems )
99+
major_updates_pending_no=$(echo "${major_updates_pending}" | jq -r .additionalData.totalItems )
100+
requires_review_no=$(echo "${requires_review}" |jq -r .additionalData.totalItems )
101+
high_license_risk_no=$(echo "${high_license_risk}" | jq -r '.retVal[].riskScore.riskScore | select( . != null ) > 52 | select(.==true)'| wc -l )
102+
103+
function print {
104+
printf "############################################\n$1\n############################################\nMend Scan Tool: https://sap.whitesourcesoftware.com/Wss/WSS.html#!login \n"
105+
}
106+
107+
function restricted_license {
108+
declare -a sap_restricted_licenses=("LGPL" "GPL" "Affero%20GPL" "MPL" "CDDL" "EPL")
109+
ret_val=""
110+
issue_count=0
111+
for key in "${!sap_restricted_licenses[@]}"; do
112+
api_resp=$(curl -X GET "https://api-sap.whitesourcesoftware.com/api/v2.0/projects/${PROJECT_TOKEN}/libraries/licenses?search=license%3Aequals%3A${sap_restricted_licenses[$key]}" \
113+
--header 'Content-Type: application/json' --silent \
114+
--header "Authorization: Bearer ${login_token}")
37115
116+
api_resp_no=$(echo "${api_resp}" | jq .additionalData.totalItems )
117+
issue_count=$((issue_count+api_resp_no))
118+
119+
if [[ $api_resp_no -gt 0 ]]
120+
then
121+
val=$(echo "${api_resp}" | jq -r .retVal[] )
122+
ret_val="$ret_val$val"
123+
fi
124+
done
125+
export VIOLATIONS_VERBOSE="${ret_val}"
126+
export VIOLATIONS="${issue_count}"
127+
}
128+
129+
print "HIGH/CRITICAL SECURITY VULNERABILITIES: ${security_vulnerability_no}"
130+
if [[ $security_vulnerability_no -gt 0 ]]
131+
then
132+
echo "${security_vulnerability}" | jq -r .retVal[]
133+
fi
134+
135+
print "MAJOR UPDATES AVAILABLE: ${major_updates_pending_no}"
136+
if [[ $major_updates_pending_no -gt 0 ]]
137+
then
138+
echo "${major_updates_pending}" | jq -r .retVal[]
139+
fi
140+
141+
print "LICENSE REQUIRES REVIEW: ${requires_review_no}" "Visit the Mend UI and add correct license"
142+
if [[ $requires_review_no -gt 0 ]]
143+
then
144+
echo "${requires_review}" | jq -r .retVal[]
145+
fi
146+
147+
print "LICENSE RISK HIGH: ${high_license_risk_no}"
148+
if [[ high_license_risk_no -gt 0 ]]
149+
then
150+
echo "Visit the Mend UI and check High Risk Licenses. Understand Risk Score: https://docs.mend.io/bundle/sca_user_guide/page/understanding_risk_score_attribution_and_license_analysis.html"
151+
fi
152+
153+
restricted_license
154+
155+
print "RESTRICTIED LICENSE FOR ON-PREMISE DELIVERY: ${VIOLATIONS}"
156+
if [[ $VIOLATIONS -gt 0 ]]
157+
then
158+
echo "${VIOLATIONS_VERBOSE}" | jq .
159+
fi
160+
161+
echo "security_vulnerability_no=$security_vulnerability_no" >> $GITHUB_OUTPUT
162+
echo "major_updates_pending_no=$major_updates_pending_no" >> $GITHUB_OUTPUT
163+
echo "requires_review_no=$requires_review_no" >> $GITHUB_OUTPUT
164+
echo "high_license_risk_no=$high_license_risk_no" >> $GITHUB_OUTPUT
165+
echo "violations=$VIOLATIONS" >> $GITHUB_OUTPUT
166+
167+
if [[ $security_vulnerability_no -gt 0 ]] || [[ $major_updates_pending_no -gt 0 ]] || [[ $requires_review_no -gt 0 ]] || [[ high_license_risk_no -gt 0 ]] || [[ violations -gt 0 ]]
168+
then
169+
echo "status=x" >> $GITHUB_OUTPUT
170+
else
171+
echo "status=white_check_mark" >> $GITHUB_OUTPUT
172+
fi
173+
174+
- name: Comment Mend Status on PR
175+
uses: thollander/[email protected]
176+
with:
177+
message: |
178+
## Mend Scan Summary: :${{ steps.report.outputs.status }}:
179+
### Repository: ${{ github.repository }}
180+
| VIOLATION DESCRIPTION | NUMBER OF VIOLATIONS |
181+
| -------------------------------------------- | --------------------------- |
182+
| HIGH/CRITICAL SECURITY VULNERABILITIES | ${{ steps.report.outputs.security_vulnerability_no }} |
183+
| MAJOR UPDATES AVAILABLE | ${{ steps.report.outputs.major_updates_pending_no }} |
184+
| LICENSE REQUIRES REVIEW | ${{ steps.report.outputs.requires_review_no }} |
185+
| LICENSE RISK HIGH | ${{ steps.report.outputs.high_license_risk_no }} |
186+
| RESTRICTIED LICENSE FOR ON-PREMISE DELIVERY | ${{ steps.report.outputs.VIOLATIONS }} |
187+
188+
[Detailed Logs: mend-scan-> Generate Report](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
189+
[Mend UI](https://sap.whitesourcesoftware.com/Wss/WSS.html#!login)
190+
comment_tag: tag_mend_scan
191+
192+

0 commit comments

Comments
 (0)