diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 7b415a1..05bd6d1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -30,8 +30,9 @@ jobs: # - https://gh.io/using-larger-runners (GitHub.com only) # Consider using larger runners or machines with greater resources for possible analysis time improvements. - # runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} - runs-on: [ self-hosted, macos ] + #runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + #runs-on: [ self-hosted, macos ] + runs-on: ['macos-latest'] #timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }} timeout-minutes: 120 @@ -50,9 +51,11 @@ jobs: strategy: fail-fast: false matrix: + swift: ["5.10.1", "5.10.0"] + os: [macos-latest] include: - language: swift - #build-mode: autobuild + # build-mode: autobuild # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' # Use `c-cpp` to analyze code written in C, C++ or both # Use 'java-kotlin' to analyze code written in Java, Kotlin or both @@ -62,14 +65,24 @@ jobs: # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: + - name: Initialize latest xcode + uses: maxim-lobanov/setup-xcode@v1 + with: + xcode-version: latest-stable + + - name: Initialize Swift + uses: swift-actions/setup-swift@v2.1.0 + with: + swift-version: ${{ matrix.swift }} + + - name: Get swift version + run: swift --version + - name: Checkout repository - #uses: actions/checkout@v4 uses: actions/checkout@v4.1.7 - # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - #uses: github/codeql-action/init@v3 - uses: github/codeql-action/init@v3.25.10 + uses: github/codeql-action/init@v3.25.12 with: languages: ${{ matrix.language }} #build-mode: ${{ matrix.build-mode }} @@ -92,7 +105,7 @@ jobs: # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift). # If this step fails, then you should remove it and run the build manually (see below) - name: Autobuild - uses: github/codeql-action/autobuild@v3.25.10 + uses: github/codeql-action/autobuild@v3.25.12 #- if: matrix.build-mode == 'manual' @@ -112,7 +125,6 @@ jobs: - name: Perform CodeQL Analysis - #uses: github/codeql-action/analyze@v3 - uses: github/codeql-action/autobuild@v3.25.10 + uses: github/codeql-action/autobuild@v3.25.12 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/mobsf.yml b/.github/workflows/mobsf.yml new file mode 100644 index 0000000..ad6b289 --- /dev/null +++ b/.github/workflows/mobsf.yml @@ -0,0 +1,66 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Vulnerability Scan with MobSF + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '30 6 * * 1' + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +permissions: + contents: read + +jobs: + mobile-security: + name: MobSF Scan + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + + # The type of runner that the job will run on + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4.1.7 + + # Sets up the python as a prerequisites for MobSF + - name: Setup python + uses: actions/setup-python@v5.1.1 + with: + python-version: 3.8 + + # Sets up the reviewdog cli + - name: Setup reviewdog + uses: reviewdog/action-setup@v1.3.0 + + - name: Show reviewdog version + run: reviewdog -version + + # Performs analysis using MobSF and outputs a Sarif Report + - name: Run mobsfscan + uses: MobSF/mobsfscan@849b749e7f3244c7b4f418ff858a9fa4e1406115 + with: + args: . --sarif --output mobsf.sarif.json || true + + # Uploads Sarif Report to GitHub + - name: Upload mobsfscan report + uses: github/codeql-action/upload-sarif@v3.25.12 + if: success() || failure() + with: + sarif_file: mobsf.sarif.json + + # Process Sarif Report file from MobSF with reviewdog cli + - name: Run reviewdog + env: + REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} + if: success() || failure() + run: reviewdog -f=sarif -diff="git diff FETCH_HEAD" -name="mobsf" -reporter=github-pr-check < mobsf.sarif.json \ No newline at end of file diff --git a/.github/workflows/swiftlint.yml b/.github/workflows/swiftlint.yml new file mode 100644 index 0000000..447672d --- /dev/null +++ b/.github/workflows/swiftlint.yml @@ -0,0 +1,54 @@ +name: SwiftLint + +on: + # Triggers the workflow on push or pull request events but only for default and protected branches + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +jobs: + scan-app: + name: Swift Lint Check for app + permissions: + # required for all workflows + security-events: write + # only required for workflows in private repositories + actions: read + contents: read + + runs-on: ubuntu-latest + steps: + # Sets up the reviewdog cli + - name: Setup reviewdog + uses: reviewdog/action-setup@v1.3.0 + + - name: Show reviewdog version + run: reviewdog -version + + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - name: Checkout repository + uses: actions/checkout@v4.1.7 + + # Performs analysis using Swift Lint and outputs a Sarif Report + - name: GitHub Action for SwiftLint + uses: stanfordbdhg/action-swiftlint@v4 + with: + args: --reporter sarif --output lint-results-debug.sarif + # https://github.com/realm/SwiftLint/issues/4048 + + # Uploads Sarif Report for the app to GitHub + - name: Upload Swift app report + uses: github/codeql-action/upload-sarif@v3.25.12 + if: success() || failure() + with: + sarif_file: lint-results-debug.sarif + + # Process checkstyle Report file from Swift Lint with reviewdog cli + - name: Run reviewdog for app + if: success() || failure() + env: + REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: reviewdog -f=sarif -diff="git diff FETCH_HEAD" -name="lint" -reporter=github-pr-check < lint-results-debug.sarif