From 0d73e505aee106df3ffbfe49aa08263f2aac5e35 Mon Sep 17 00:00:00 2001 From: Paolo del Mundo <68116003+TMFRook@users.noreply.github.com> Date: Mon, 7 Jun 2021 12:25:07 -0700 Subject: [PATCH] Add shiftleft.yml (#17) Adds shiftleft.yml with `--cpg` flag --- .github/workflows/shiftleft.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/shiftleft.yml diff --git a/.github/workflows/shiftleft.yml b/.github/workflows/shiftleft.yml new file mode 100644 index 0000000..c4698dd --- /dev/null +++ b/.github/workflows/shiftleft.yml @@ -0,0 +1,30 @@ +# Shiftleft engine v2 +name: Analyze with ShiftLeft NG SAST + +on: + pull_request: # include to analyze when you create a pull request + branches: + - master + workflow_dispatch: + +jobs: + NGSAST: + runs-on: ubuntu-20.04 + steps: + - uses: actions/checkout@v2 + - name: Download ShiftLeft cli + run: | + curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl + - run: echo REPOSITORY_NAME=$(echo "$GITHUB_REPOSITORY" | awk -F / '{print $2}') >> $GITHUB_ENV + shell: bash + - name: Python + if: env.SHIFTLEFT_ACCESS_TOKEN != null + run: | + python3 -m venv .venv + . .venv/bin/activate + pip install --upgrade setuptools wheel + [ -f requirements.txt ] && pip install -r requirements.txt + [ -f requirements/default.txt ] && pip install -r requirements/default.txt + ${GITHUB_WORKSPACE}/sl analyze --tag app.group=$REPOSITORY_NAME --app ${REPOSITORY_NAME}-python --cpg --tag branch=${GITHUB_REF} --python $(pwd) + env: + SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}