From 2413c72586e6288ac8bbbb9e01d76bb5e72bdb84 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Apr 2022 20:35:53 +0000 Subject: [PATCH 01/30] Bump minimist from 1.2.5 to 1.2.6 Bumps [minimist](https://github.com/substack/minimist) from 1.2.5 to 1.2.6. - [Release notes](https://github.com/substack/minimist/releases) - [Commits](https://github.com/substack/minimist/compare/1.2.5...1.2.6) --- updated-dependencies: - dependency-name: minimist dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 64254ae..58e7c9e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1834,9 +1834,9 @@ } }, "minimist": { - "version": "1.2.5", - "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz", - "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==", + "version": "1.2.6", + "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz", + "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==", "dev": true }, "mkdirp": { From 328f32c33722bbdbcf6b54c3736d9bf219ba2f12 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Apr 2022 20:36:08 +0000 Subject: [PATCH 02/30] Bump ansi-regex from 3.0.0 to 3.0.1 Bumps [ansi-regex](https://github.com/chalk/ansi-regex) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/chalk/ansi-regex/releases) - [Commits](https://github.com/chalk/ansi-regex/compare/v3.0.0...v3.0.1) --- updated-dependencies: - dependency-name: ansi-regex dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/package-lock.json b/package-lock.json index 64254ae..0a93674 100644 --- a/package-lock.json +++ b/package-lock.json @@ -371,9 +371,9 @@ "dev": true }, "ansi-regex": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz", - "integrity": "sha1-7QMXwyIGT3lGbAKWa922Bas32Zg=", + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.1.tgz", + "integrity": "sha512-+O9Jct8wf++lXxxFc4hc8LsjaSq0HFzzL7cVsw8pRDIPdjKD2mT4ytDZlLuSBZ4cLKZFXIrMGO7DbQCtMJJMKw==", "dev": true }, "ansi-styles": { @@ -681,9 +681,9 @@ }, "dependencies": { "ansi-regex": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz", - "integrity": "sha512-1apePfXM1UOSqw0o9IiFAovVz9M5S1Dg+4TrDwfMewQ6p/rmMueb7tWZjQ1rx4Loy1ArBggoqGpfqqdI4rondg==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.1.tgz", + "integrity": "sha512-ILlv4k/3f6vfQ4OoP2AGvirOktlQ98ZEL1k9FaQjxa3L1abBgbuTDAdPOpvbGncC0BTVQrl+OM8xZGK6tWXt7g==", "dev": true }, "string-width": { @@ -2123,9 +2123,9 @@ }, "dependencies": { "ansi-regex": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz", - "integrity": "sha512-1apePfXM1UOSqw0o9IiFAovVz9M5S1Dg+4TrDwfMewQ6p/rmMueb7tWZjQ1rx4Loy1ArBggoqGpfqqdI4rondg==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.1.tgz", + "integrity": "sha512-ILlv4k/3f6vfQ4OoP2AGvirOktlQ98ZEL1k9FaQjxa3L1abBgbuTDAdPOpvbGncC0BTVQrl+OM8xZGK6tWXt7g==", "dev": true }, "ansi-styles": { @@ -2896,9 +2896,9 @@ }, "dependencies": { "ansi-regex": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz", - "integrity": "sha512-1apePfXM1UOSqw0o9IiFAovVz9M5S1Dg+4TrDwfMewQ6p/rmMueb7tWZjQ1rx4Loy1ArBggoqGpfqqdI4rondg==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.1.tgz", + "integrity": "sha512-ILlv4k/3f6vfQ4OoP2AGvirOktlQ98ZEL1k9FaQjxa3L1abBgbuTDAdPOpvbGncC0BTVQrl+OM8xZGK6tWXt7g==", "dev": true }, "ansi-styles": { @@ -2988,9 +2988,9 @@ }, "dependencies": { "ansi-regex": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz", - "integrity": "sha512-1apePfXM1UOSqw0o9IiFAovVz9M5S1Dg+4TrDwfMewQ6p/rmMueb7tWZjQ1rx4Loy1ArBggoqGpfqqdI4rondg==", + "version": "4.1.1", + "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.1.tgz", + "integrity": "sha512-ILlv4k/3f6vfQ4OoP2AGvirOktlQ98ZEL1k9FaQjxa3L1abBgbuTDAdPOpvbGncC0BTVQrl+OM8xZGK6tWXt7g==", "dev": true }, "find-up": { From b24282f3a525954e0cf623092e2a5386dbb7d80c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Apr 2022 20:36:13 +0000 Subject: [PATCH 03/30] Bump node-fetch from 2.6.1 to 2.6.7 Bumps [node-fetch](https://github.com/node-fetch/node-fetch) from 2.6.1 to 2.6.7. - [Release notes](https://github.com/node-fetch/node-fetch/releases) - [Commits](https://github.com/node-fetch/node-fetch/compare/v2.6.1...v2.6.7) --- updated-dependencies: - dependency-name: node-fetch dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 64254ae..8b7860a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2012,9 +2012,12 @@ } }, "node-fetch": { - "version": "2.6.1", - "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz", - "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==" + "version": "2.6.7", + "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz", + "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==", + "requires": { + "whatwg-url": "^5.0.0" + } }, "normalize-path": { "version": "3.0.0", @@ -2759,6 +2762,11 @@ "is-number": "^7.0.0" } }, + "tr46": { + "version": "0.0.3", + "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz", + "integrity": "sha1-gYT9NH2snNwYWZLzpmIuFLnZq2o=" + }, "trim-repeated": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/trim-repeated/-/trim-repeated-1.0.0.tgz", @@ -2854,6 +2862,20 @@ "defaults": "^1.0.3" } }, + "webidl-conversions": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz", + "integrity": "sha1-JFNCdeKnvGvnvIZhHMFq4KVlSHE=" + }, + "whatwg-url": { + "version": "5.0.0", + "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz", + "integrity": "sha1-lmRU6HZUYuN2RNNib2dCzotwll0=", + "requires": { + "tr46": "~0.0.3", + "webidl-conversions": "^3.0.0" + } + }, "which": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz", From d87520a0621842d0c75be13eccfd8715501e8d91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Apr 2022 20:36:28 +0000 Subject: [PATCH 04/30] Bump glob-parent from 5.1.1 to 5.1.2 Bumps [glob-parent](https://github.com/gulpjs/glob-parent) from 5.1.1 to 5.1.2. - [Release notes](https://github.com/gulpjs/glob-parent/releases) - [Changelog](https://github.com/gulpjs/glob-parent/blob/main/CHANGELOG.md) - [Commits](https://github.com/gulpjs/glob-parent/compare/v5.1.1...v5.1.2) --- updated-dependencies: - dependency-name: glob-parent dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 64254ae..1a0c8ce 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1392,9 +1392,9 @@ } }, "glob-parent": { - "version": "5.1.1", - "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz", - "integrity": "sha512-FnI+VGOpnlGHWZxthPGR+QhR78fuiK0sNLkHQv+bL9fQi57lNNdquIbna/WrfROrolq8GK5Ek6BiMwqL/voRYQ==", + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", + "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", "requires": { "is-glob": "^4.0.1" } From 05a9c05a0e7db8f128aeb438dd90019eeb4ca1a6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Apr 2022 20:36:34 +0000 Subject: [PATCH 05/30] Bump pathval from 1.1.0 to 1.1.1 Bumps [pathval](https://github.com/chaijs/pathval) from 1.1.0 to 1.1.1. - [Release notes](https://github.com/chaijs/pathval/releases) - [Changelog](https://github.com/chaijs/pathval/blob/master/CHANGELOG.md) - [Commits](https://github.com/chaijs/pathval/compare/v1.1.0...v1.1.1) --- updated-dependencies: - dependency-name: pathval dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 64254ae..7a2b1fe 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2280,9 +2280,9 @@ "dev": true }, "pathval": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.0.tgz", - "integrity": "sha1-uULm1L3mUwBe9rcTYd74cn0GReA=", + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/pathval/-/pathval-1.1.1.tgz", + "integrity": "sha512-Dp6zGqpTdETdR63lehJYPeIOqpiNBNtc7BpWSLrOje7UaIsE5aY92r/AunQA7rsXvet3lrJ3JnZX29UPTKXyKQ==", "dev": true }, "pend": { From 13b71df76844fc86d02145c5c5b0a33376dda669 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Apr 2022 20:36:36 +0000 Subject: [PATCH 06/30] Bump ws from 7.4.2 to 7.5.7 Bumps [ws](https://github.com/websockets/ws) from 7.4.2 to 7.5.7. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](https://github.com/websockets/ws/compare/7.4.2...7.5.7) --- updated-dependencies: - dependency-name: ws dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 64254ae..964b6f8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2953,9 +2953,9 @@ "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=" }, "ws": { - "version": "7.4.2", - "resolved": "https://registry.npmjs.org/ws/-/ws-7.4.2.tgz", - "integrity": "sha512-T4tewALS3+qsrpGI/8dqNMLIVdq/g/85U98HPMa6F0m6xTbvhXU6RCQLqPH3+SlomNV/LdY6RXEbBpMH6EOJnA==" + "version": "7.5.7", + "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.7.tgz", + "integrity": "sha512-KMvVuFzpKBuiIXW3E4u3mySRO2/mCHSyZDJQM5NQ9Q9KHWHWh0NHgfbRMLLrceUK5qAL4ytALJbpRMjixFZh8A==" }, "xtend": { "version": "4.0.2", From 407fd50ab3f5144a0f623a4f4c86bf63f04bd045 Mon Sep 17 00:00:00 2001 From: jorge-abarca <29783307+jorge-abarca@users.noreply.github.com> Date: Tue, 19 Apr 2022 17:14:39 -0500 Subject: [PATCH 07/30] Extended support for other reports --- action.yml | 5 ++ src/ReportGenerator.ts | 2 +- src/index.ts | 2 +- templates/components/sast/alerts.html | 57 ++++++++++++++ templates/components/sast/coverage.html | 34 +++++++++ templates/components/sast/summary.html | 55 ++++++++++++++ templates/components/sca/manifests.html | 39 ++++++++++ templates/components/sca/security.html | 74 ++++++++++++++++++ templates/components/sca/summary.html | 55 ++++++++++++++ templates/components/secrets/summary.html | 45 +++++++++++ templates/report.html | 92 +++++++++++++++++++++++ 11 files changed, 458 insertions(+), 2 deletions(-) create mode 100644 templates/components/sast/alerts.html create mode 100644 templates/components/sast/coverage.html create mode 100644 templates/components/sast/summary.html create mode 100644 templates/components/sca/manifests.html create mode 100644 templates/components/sca/security.html create mode 100644 templates/components/sca/summary.html create mode 100644 templates/components/secrets/summary.html create mode 100644 templates/report.html diff --git a/action.yml b/action.yml index 67d40c6..1f512a8 100644 --- a/action.yml +++ b/action.yml @@ -21,6 +21,11 @@ inputs: description: Repository name with owner. For example, peter-murray/github-security-report required: true default: ${{ github.repository }} + + template: + description: Select the report template type you want to use. For example, `summary` or `report`. + required: false + default: summary runs: using: node12 diff --git a/src/ReportGenerator.ts b/src/ReportGenerator.ts index 9785196..3aace90 100644 --- a/src/ReportGenerator.ts +++ b/src/ReportGenerator.ts @@ -39,7 +39,7 @@ export default class ReportGenerator { .then(html => { return mkdirP(config.outputDirectory) .then(() => { - return createPDF(html, path.join(config.outputDirectory, 'summary.pdf')); + return createPDF(html, path.join(config.outputDirectory, config.templating.name + '.pdf')); }); }); } diff --git a/src/index.ts b/src/index.ts index 8a0ce47..446f9a2 100644 --- a/src/index.ts +++ b/src/index.ts @@ -15,7 +15,7 @@ async function run(): Promise { outputDirectory: getRequiredInputValue('outputDir'), templating: { - name: 'summary' + name: getRequiredInputValue('template') } }); diff --git a/templates/components/sast/alerts.html b/templates/components/sast/alerts.html new file mode 100644 index 0000000..d1f3353 --- /dev/null +++ b/templates/components/sast/alerts.html @@ -0,0 +1,57 @@ +{% if scanning.results.open.scans.error %} +
+
+
+
Errors
+
{{ scanning.results.open.scans.error | length }}
+
+ + + + + + + + + + {% for alert in scanning.results.open.scans.error %} + + + + + + {% endfor %} + +
RuleFound onDiscovered by
{{ alert.name }}{{ alert.created }}{{ alert.tool }}
+
+
+{% endif %} + +{% if scanning.results.open.scans.warning %} +
+
+
+
Warnings
+
{{ scanning.results.open.scans.warning | length }}
+
+ + + + + + + + + + {% for alert in scanning.results.open.scans.warning %} + + + + + + {% endfor %} + +
RuleFound onDiscovered by
{{ alert.name }}{{ alert.created }}{{ alert.tool }}
+
+
+{% endif %} diff --git a/templates/components/sast/coverage.html b/templates/components/sast/coverage.html new file mode 100644 index 0000000..df53ae4 --- /dev/null +++ b/templates/components/sast/coverage.html @@ -0,0 +1,34 @@ +
+
+
+

Code Scanning Vulnerabilities

+
+
+
+
+
+
+
Code Scanning Rules Applied
+
{{ scanning.rules | length }}
+
+
+
+
+
+
+
CWE Coverage
+
{{ scanning.cwe.cwes | length }}
+
+
+
+
    + {% for cwe in scanning.cwe.cwes | sort %} +
  • {{ cwe }}
    • + {% endfor %} +
+
+
+
+
+
+
\ No newline at end of file diff --git a/templates/components/sast/summary.html b/templates/components/sast/summary.html new file mode 100644 index 0000000..b417424 --- /dev/null +++ b/templates/components/sast/summary.html @@ -0,0 +1,55 @@ +
+
+
+

Code Scanning Summary

+
+
+ +
+
+ {% if scanning.results.open %} +
+
+
Open Findings
+
{{ scanning.results.open.total }}
+
+
+ {% if scanning.results.open.total > 0 %} + + + {% else %} + + {% endif %} +
+
+ {% endif %} +
+ +
+ {% if scanning.results.closed %} +
+
+
Closed Findings
+
{{ scanning.results.closed.total }}
+
+
+ {% if scanning.results.closed.total > 0 %} + + + {% else %} + + {% endif %} +
+
+ {% endif %} +
+
+
\ No newline at end of file diff --git a/templates/components/sca/manifests.html b/templates/components/sca/manifests.html new file mode 100644 index 0000000..ad97e0e --- /dev/null +++ b/templates/components/sca/manifests.html @@ -0,0 +1,39 @@ +{% if sca.dependencies.manifests.processed %} +
+
+
+

Software Composition Analysis - Manifests

+
+
+ +
+
+
+
Processed Manifest Files
+
{{ sca.dependencies.manifests.processed | length }}
+
+ + + + + + + + + {% for processed in sca.dependencies.manifests.processed %} +
  • {{ cwe }}
    • + + + + {% endfor %} + + +
    Name
    + + {{ processed.filename }} + +
    +
    +
    +
    +{% endif %} \ No newline at end of file diff --git a/templates/components/sca/security.html b/templates/components/sca/security.html new file mode 100644 index 0000000..d907478 --- /dev/null +++ b/templates/components/sca/security.html @@ -0,0 +1,74 @@ +{% macro securityDependencies(criticality, breakline = false) %} +{% if sca.vulnerabilities.bySeverity[criticality] %} + +{% set vulnerabilities = sca.vulnerabilities.bySeverity[criticality] %} + +
    +
    +
    +
    {{ criticality | title }}
    +
    {{ vulnerabilities | length }}
    +
    + + + + + + + + + + + + {% for vulnerability in vulnerabilities %} +
  • {{ cwe }}
    • + + + + + + + {% endfor %} + +
    # Advisory IDPackage Name / VersionManager / PathCreated
    + + {{ vulnerability.data.securityAdvisory.ghsaId }} + + + {{ vulnerability.data.securityVulnerability.package.name }} {{ + vulnerability.data.vulnerableRequirements }} + + {{ vulnerability.data.securityVulnerability.package.ecosystem }} - {{ + vulnerability.data.vulnerableManifestPath }} + + {{ vulnerability.data.createdAt }} +
    +
    +
    + +{% if breakline %} +
     
    +{% endif %} + +{% endif %} +{% endmacro %} + + +{% if sca.vulnerabilities %} +
    +
    +
    +

    Software Composition Analysis Vulnerabilities

    +
    +
    + + {{ securityDependencies('critical', breakline=true) }} + + {{ securityDependencies('high', breakline=true) }} + + {{ securityDependencies('moderate', breakline=true) }} + + {{ securityDependencies('low') }} + +
    +{% endif %} \ No newline at end of file diff --git a/templates/components/sca/summary.html b/templates/components/sca/summary.html new file mode 100644 index 0000000..fd5d427 --- /dev/null +++ b/templates/components/sca/summary.html @@ -0,0 +1,55 @@ +
    +
    +
    +

    Software Composition Analysis Summary

    +
    +
    + +
    +
    +
    +
    +
    Dependencies
    +
    {{ sca.dependencies.totalDependencies }}
    +
    + +
    + + +
    +
    +
    + + {% if sca.vulnerabilities %} +
    +
    +
    +
    Dependency Vulnerabilities
    +
    {{ sca.vulnerabilities.total }}
    +
    + +
    + + + + +
    +
    +
    + {% endif %} +
    +
    \ No newline at end of file diff --git a/templates/components/secrets/summary.html b/templates/components/secrets/summary.html new file mode 100644 index 0000000..909581e --- /dev/null +++ b/templates/components/secrets/summary.html @@ -0,0 +1,45 @@ +
    +
    +
    +

    Secret Scanning Summary

    +
    +
    + +
    +
    +
    +
    +
    Secrets Status
    +
    4
    +
    + +
    + + +
    +
    +
    + +
    +
    +
    +
    Exposed Secrets
    +
    3
    +
    + +
    + + +
    +
    +
    +
    +
    \ No newline at end of file diff --git a/templates/report.html b/templates/report.html new file mode 100644 index 0000000..c014b7f --- /dev/null +++ b/templates/report.html @@ -0,0 +1,92 @@ + + + + + + GitHub Advanced Security Report + + + + + + + + + + +
    +
    +
    + +

    GitHub Advanced Security
    Full Report

    +
    +
    + +
    +
    GitHub Repository:
    +
    {{ github.owner }}/{{ github.repo }}
    + +
    Generated:
    +
    {{ metadata.created }}
    + +
    + + {% if sca %} + {% include "components/sca/summary.html" %} + {% endif %} + + {% if scanning %} + {% include "components/sast/summary.html" %} + {% endif %} + + {% if secrets %} + {% include "components/secrets/summary.html" %} + {% endif %} + +
     
    + + {% include "components/sca/manifests.html" %} + + {% include "components/sca/security.html" %} + +
     
    + + {% include "components/sast/coverage.html" %} + + {% if scanning %} + {% include "components/sast/alerts.html" %} + {% endif %} +
    + + + + From ad67c93c78f60e742d2dc74a5b4c160fed36f1d6 Mon Sep 17 00:00:00 2001 From: jorge-abarca <29783307+jorge-abarca@users.noreply.github.com> Date: Tue, 19 Apr 2022 17:39:20 -0500 Subject: [PATCH 08/30] Added template support for CLI --- README.md | 13 ++++++++++--- src/executable.ts | 9 +++++---- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 5c8a76c..dbd40aa 100644 --- a/README.md +++ b/README.md @@ -27,12 +27,18 @@ saving it in the specified directory. * `sarifReportDir`: The directory to look for SARIF reports (from the CodeQL analyze action this defaults to `../results`) * `outputDir`: The output directory for the PDF reports, defaults to `github.workspace` * `repository`: The repository in `/` form, defaults to `github.repository` +* `template`: The report template type used to render the report, defaults to `summary` ## Templates -Currently the templates are hard coded into the action. There are extension points built into the action that will allow -a future release to provide customization of these templates, via an ability to specify your own. +Currently there is partial support for templates that are included in the action. Extenders of the action are welcome to author +additional templates by creating HTML templates using [Nunjucks](https://mozilla.github.io/nunjucks/templating.html) inside the `templates` folder. + +You can specify a template by using the `template` parameter. Currently the following templates are availale: +* `summary`: The classic summary report from previous versions. +* `report`: A more detailed report that includes a list of open alerts broken down by their severity. +* `report_sca`: A report that includes Software Composition Analysis ## Examples @@ -67,6 +73,7 @@ Options: * `-r`, `--repository`: The repository that contains the source code, in `/` form, e.g. `peter-murray/node-hue-api` * `-s`, `--sarif-directory`: The directory containing the SARIF report files * `-o`, `--output-directory`: The directory to output the PDF report to. This will be created if it does not exist. +* `--template`: The report template type used to render the report. This defaults to `summary`. An example of running the MacOS command line executable from the un: ``` @@ -76,6 +83,6 @@ The above command would output a `summary.pdf` file in the current working direc ## Future improvements -* Add support for selecting reporting templates to the parameters +* Additional work on the currently available reports * Example of extending html templates and using them diff --git a/src/executable.ts b/src/executable.ts index a2e4c84..781f9ed 100644 --- a/src/executable.ts +++ b/src/executable.ts @@ -8,9 +8,10 @@ program.name('github-security-report'); program.version(require('../package.json').version); program.requiredOption('-t, --token ', 'github access token'); -program.requiredOption('-r --repository ', 'github repository, owner/repo_name format'); -program.option('-s --sarif-directory ', 'the SARIF report directory to load reports from', '../results'); -program.option('-o --output-directory ', 'output directory for summary report', '.'); +program.requiredOption('-r, --repository ', 'github repository, owner/repo_name format'); +program.option('-s, --sarif-directory ', 'the SARIF report directory to load reports from', '../results'); +program.option('-o, --output-directory ', 'output directory for the report', '.'); +program.option('--template