A GitHub action for organizations that enables advanced security code scanning on all new repos

Overview

Advanced-Security-Enforcer

CodeQL Docker Image CI .github/workflows/linter.yml

What this repository does

This code is for an active GitHub Action written in Python to check (on a schedule) for new repositories created in the last 24 hours and open pull requests in the new repositories to enable GitHub advanced security code scanning.

Support

If you need support using this project or have questions about it, please open up an issue in this repository. Requests made directly to GitHub staff or support team will be redirected here to open an issue. GitHub SLA's and support/services contracts do not apply to this repository.

Example workflow

name: Enforce advanced security scanning

on:
  repository_dispatch:
  schedule:
    - cron: '00 5 * * *'

jobs:
  build:
    name: Enforce advanced security scanning
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/[email protected]
    
    - name: Run enforcer tool
      uses: github/[email protected]
      env:
        GH_ACTOR: ${{ secrets.GH_ACTOR }}
        GH_TOKEN: ${{ secrets.GH_TOKEN }}
        ORGANIZATION: ${{ secrets.ORGANIZATION }}
        PR_BODY: your text goes here
  • Be sure to fill out the env values above with your information. More info on creating secrets can be found here.
  • Your GitHub token will need to have read/write access to all the repos in the organization

How it does this

  • A CRON job on GitHub actions triggers a nightly run of this script
  • The script checks for new repositories by storing the known repositories to a file
  • It then iterates over new repositories and opens a pull request for the codeql.yml file stored in this repository

Contributions

We would ❤️ contributions to improve this action. Please see CONTRIBUTING.md for how to get involved.

Instructions to run locally

  • Clone the repository
  • Create a personal access token with read only permissions
  • Copy the .env-example file to .env
  • Edit the .env file by adding your Personal Access Token to it and the desired organization
  • Install dependencies pip install -r requirements.txt
  • Run the code python3 enforcer.py
  • Note the log output for details on any pull requests that were opened
  • After running locally this will have changed your git config user.name and user.email so those should be reset for this repository

License

MIT

Issues
  • Add support expectations

    Add support expectations

    null

    opened by zkoppert 0
  • update repo link

    update repo link

    null

    bug 
    opened by zkoppert 0
  • Update repository links

    Update repository links

    null

    documentation 
    opened by zkoppert 0
  • Use prebuilt docker image for performance

    Use prebuilt docker image for performance

    null

    enhancement 
    opened by zkoppert 0
  • Fix path from getting overridden by docker

    Fix path from getting overridden by docker

    opened by zkoppert 0
  • Add debug instructions for docker

    Add debug instructions for docker

    opened by zkoppert 0
  • Create SECURITY.md

    Create SECURITY.md

    null

    opened by zkoppert 0
  • Create LICENSE

    Create LICENSE

    null

    opened by zkoppert 0
  • use pipenv instead of pip in docker build

    use pipenv instead of pip in docker build

    Docker builds are giving a warning that pip should not be used as root. It suggests configuring pipenv.

    WARNING: Running pip as the 'root' user can result in broken permissions and conflicting behaviour with the system package manager. It is recommended to use a virtual environment instead: https://pip.pypa.io/warnings/venv

    see here for an example of this error as seen in the log.

    bug 
    opened by zkoppert 0
  • Bump github3-py from 1.3.0 to 2.0.0

    Bump github3-py from 1.3.0 to 2.0.0

    Bumps github3-py from 1.3.0 to 2.0.0.

    Commits
    • 9345f86 Release v2.0
    • 6572d75 Merge pull request #1020 from sigmavirus24/fix-history-keyerrors
    • 2bf6380 Rollback changes to unnecessary fields
    • 0f2b844 Fix gist.history keyerrors
    • 99c6515 Merge pull request #1017 from sigmavirus24/add-github-labeler
    • 0632e9b Add Github Labeler
    • 404ea04 Merge pull request #1015 from sigmavirus24/remove-unicode-handling
    • b28febf Add changes to release notes
    • cd1af16 Remove unicode legacy code
    • 5766ecd Merge pull request #1013 from sigmavirus24/deprecated-code-removal
    • Additional commits viewable in compare view

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    dependencies 
    opened by dependabot[bot] 1
Releases(v1.0.2)
  • v1.0.2(Oct 13, 2021)

    Changelog

    🚀 Features

    • Use prebuilt docker image for performance @zkoppert (#18)
    • Add debug instructions for docker @zkoppert (#14)

    🐛 Bug Fixes

    • Ensure the codeql configuration file is present in the docker container @zkoppert (#17)
    • Change to UI based manual actions kickoff instead of API based @zkoppert (#15)
    • Fix path from getting overridden by docker @zkoppert (#16)

    See details of all code changes since previous release

    Source code(tar.gz)
    Source code(zip)
  • v1.0.0(Oct 8, 2021)

    🎉 The initial release of the advanced-security-enforcer!

    🚀 Features

    • Customizable pull request body
    • Opens pull request on any repo created within the last 24 hours
    • Scoped to a specific organization

    ⏳ What's Changed

    • Create LICENSE by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/1
    • Create codeql-analysis.yml by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/2
    • Bump python-dotenv from 0.15.0 to 0.19.0 by @dependabot in https://github.com/github/advanced-security-enforcer/pull/4
    • Quote to prevent word splitting by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/5
    • Add release drafter by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/6
    • Expand README sections by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/9
    • Create CODE_OF_CONDUCT.md by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/8
    • Add release procedure by @zkoppert in https://github.com/github/advanced-security-enforcer/pull/10

    🧑🏻‍🤝‍🧑🏻 New Contributors

    • @zkoppert made their first contribution in https://github.com/github/advanced-security-enforcer/pull/1
    • @AAugustine made their first contribution in https://github.com/github/advanced-security-enforcer/pull/1
    • @dependabot made their first contribution in https://github.com/github/advanced-security-enforcer/pull/4

    Full Changelog: https://github.com/github/advanced-security-enforcer/commits/v1.0.0

    Source code(tar.gz)
    Source code(zip)
  • v1.0.1(Oct 12, 2021)

Owner
Zack Koppert
Open/Inner Source enthusiast Senior Software Engineer, Professional Services @github
Zack Koppert
Malicious traffic detection system

Content Introduction Architecture Demo pages Requirements Quick start Administrator's guide Sensor Server User's guide Reporting interface Real-life c

Miroslav Stampar 4.2k Oct 25, 2021
WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities

WebScan is a web vulnerability Scanning tool, which scans sites for SQL injection and XSS vulnerabilities Which is a great tool for web pentesters. Coded in python3, CLI. WebScan is capable of scanning and detecting sql injection vulnerabilities across HTTP and HTTP sites.

AnonyminHack5 14 Sep 18, 2021
HTTP security headers for Flask

Talisman: HTTP security headers for Flask Talisman is a small Flask extension that handles setting HTTP headers that can help protect against a few co

Google Cloud Platform 786 Oct 9, 2021
Tools to make working the Arch Linux Security Tracker easier

This is a collection of Python scripts to make working with the Arch Linux Security Tracker easier.

Jonas Witschel 5 Oct 7, 2021
EMBArk - The firmware security scanning environment

Embark is being developed to provide the firmware security analyzer emba as a containerized service and to ease accessibility to emba regardless of system and operating system.

emba 23 Oct 21, 2021
Bandit is a tool designed to find common security issues in Python code.

A security linter from PyCQA Free software: Apache license Documentation: https://bandit.readthedocs.io/en/latest/ Source: https://github.com/PyCQA/ba

Python Code Quality Authority 3.6k Oct 22, 2021
A Static Analysis Tool for Detecting Security Vulnerabilities in Python Web Applications

This project is no longer maintained March 2020 Update: Please go see the amazing Pysa tutorial that should get you up to speed finding security vulne

null 2.1k Oct 11, 2021
Security offerings for AWS Control Tower

Caylent Security Catalyst Reference Architecture Examples This repository contains solutions for Caylent's Security Catalyst. The Security Catalyst is

Steven Connolly 1 Oct 19, 2021
APKLeaks - Scanning APK file for URIs, endpoints & secrets.

APKLeaks - Scanning APK file for URIs, endpoints & secrets.

dw1 2.6k Oct 23, 2021
LittleBrother is a simple parental control application monitoring specific processes on Linux hosts to monitor and limit the play time of children.

Parental Control Application LittleBrother Overview LittleBrother is a simple parental control application monitoring specific processes (read "games"

null 29 Oct 19, 2021
Safety checks your installed dependencies for known security vulnerabilities

Safety checks your installed dependencies for known security vulnerabilities. By default it uses the open Python vulnerability database Safety DB, but

pyup.io 1.1k Oct 22, 2021
Rouge Spammers with a mission to disrupt the peace of the valley ? Fear not we will STOMP the Spammers

Rouge Spammers with a mission to disrupt the peace of the valley ? Fear not we will STOMP the Spammers New Update : adding 'on-review' tag on an issue

A N U S H 13 Sep 19, 2021
GitLab CI security tools runner

Common Security Pipeline Описание проекта: Данный проект является вариантом реализации DevSecOps практик, на базе: GitLab DefectDojo OpenSouce tools g

Сити-Мобил 8 Oct 5, 2021
SpiderFoot automates OSINT collection so that you can focus on analysis.

SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of m

Steve Micallef 6.7k Oct 22, 2021
Most advanced XSS scanner.

XSStrike Advanced XSS Detection Suite XSStrike Wiki • Usage • FAQ • For Developers • Compatibility • Gallery XSStrike is a Cross Site Scripting detect

Somdev Sangwan 9.7k Oct 23, 2021
Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞利用功能

Vulmap 是一款 web 漏洞扫描和验证工具, 可对 webapps 进行漏洞扫描, 并且具备漏洞利用功能

之乎者也 1.9k Oct 22, 2021
OpenPort scanner GUI tool (CNMAP)

CNMAP-GUI- OpenPort scanner GUI tool (CNMAP) as you know it is the advanced tool to find open port, firewalls and we also added here heartbleed scanni

null 3 Oct 21, 2021
Infection Monkey - An automated pentest tool

Infection Monkey Data center Security Testing Tool Welcome to the Infection Monkey! The Infection Monkey is an open source security tool for testing a

Guardicore Ltd. 5.5k Oct 16, 2021
使用golang重写开源工具wafw00f

GO-WAFW00F 介绍 WAFW00F是一款优秀的web应用防火墙识别开源工具:https://github.com/EnableSecurity/wafw00f 使用Golang重写的原因:Python环境配置不便利,Golang打包生成可执行文件直接运行 目前还在开发阶段,规则解析存在小问题

null 73 Sep 8, 2021