From 11b6911d74a447427a81da1b887b3f19ca19cdb1 Mon Sep 17 00:00:00 2001 From: mohsinenar Date: Wed, 28 Sep 2022 18:56:53 +0100 Subject: [PATCH 1/3] Fix Docker file. --- Dockerfile | 1 + README.md | 36 +++++++++++++++++++----------------- 2 files changed, 20 insertions(+), 17 deletions(-) diff --git a/Dockerfile b/Dockerfile index 014265b..2fcaef9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,6 @@ FROM python:3.8-slim-buster as base FROM base as builder +RUN apk add build-base RUN mkdir /install WORKDIR /install RUN pip install --prefix=/install ostorlab diff --git a/README.md b/README.md index 8c439a5..edb3a03 100644 --- a/README.md +++ b/README.md @@ -31,24 +31,26 @@ The next steps is to a update your workflow to add an Ostorlab step to trigger t a rapid scan on an Android APK and failing the pipeline on vulnerabilities with `HIGH` severity. ```yaml -on: [push] +on: [ push ] jobs: - ostorlab_test: - runs-on: ubuntu-latest - name: Test ostorlab ci actions. - steps: - - uses: actions/checkout@v2 - - name: Launch Ostorlab scan - id: start_scan - uses: actions/ostorlab_actions@v1 - with: - scan_profile: fast_scan - asset_type: android-apk - target: andoird_apk.apk - can_title: title_scan_ci - ostorlab_api_key: ${{ secrets.ostorlab_api_key }} # your secret api key. - break_on_risk_rating: HIGH - max_wait_minutes: 20 + ostorlab_test: + runs-on: ubuntu-latest + name: Test ostorlab ci actions. + steps: + - uses: actions/checkout@v2 + - name: build ostorlab.apk + run: mv InsecureBankv2.apk ostorlab.apk + - name: Launch Ostorlab scan + id: start_scan + uses: Ostorlab/ostorlab_actions@v1.0.3 + with: + scan_profile: fast_scan # Specify which scan profile to use for the scan (check scan section). + asset_type: android-apk # type of asset to scan. + target: ostorlab.apk # path for target tto scan. + scan_title: title_scan_ci # type a title for your scan. + ostorlab_api_key: ${{ secrets.ostorlab_api_key }} # your secret api key. + break_on_risk_rating: HIGH # Wait for the scan results and force the action to fail if the scan risk is higher + max_wait_minutes: 30 ``` ### Action inputs From 90dd910e5d28f4722524e502d2322ee526490cf7 Mon Sep 17 00:00:00 2001 From: mohsinenar Date: Wed, 28 Sep 2022 19:01:43 +0100 Subject: [PATCH 2/3] Update python version to 3.10 in DockerFile. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 2fcaef9..d873580 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM python:3.8-slim-buster as base +FROM python:3.10-alpine as base FROM base as builder RUN apk add build-base RUN mkdir /install From 94109bfefe7b86c2858d688b7a2805c34fddf61f Mon Sep 17 00:00:00 2001 From: mohsinenar Date: Wed, 28 Sep 2022 19:06:20 +0100 Subject: [PATCH 3/3] add example of scan id in outputs. --- .github/workflows/action.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/action.yaml b/.github/workflows/action.yaml index 002f6b3..faf03cc 100644 --- a/.github/workflows/action.yaml +++ b/.github/workflows/action.yaml @@ -18,3 +18,5 @@ jobs: ostorlab_api_key: ${{ secrets.ostorlab_api_key }} # your secret api key. break_on_risk_rating: HIGH # Wait for the scan results and force the action to fail if the scan risk is higher max_wait_minutes: 30 + - name: Get scan id + run: echo "Scan Created with id ${{ steps.start_scan.outputs.scan_id }}"