Merge pull request #6 from philips-forks/oauth-fortify-blackduck

New commit

.github/workflows/Blackduck.yaml

@@ -0,0 +1,29 @@
+# This is a basic workflow to help you get started with Actions
+
+name: Blackduck scan
+
+# Controls when the action will run. 
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  push:
+    branches: [ main ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: builder_blr
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+          ref: main
+      - name: blackduck scan
+        run: powershell -ExecutionPolicy RemoteSigned -NoExit -File ${{ github.workspace }}\Build\PS\Invoke-BlackduckDetect.ps1 -SourcePath ${{ github.workspace }}

.github/workflows/fortify.yaml

@@ -0,0 +1,29 @@
+# This is a basic workflow to help you get started with Actions
+
+name: Fortify scan
+
+# Controls when the action will run. 
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  push:
+    branches: [ main ]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: builder_blr
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+          ref: main
+      - name: Fortify scan
+        run: powershell -ExecutionPolicy RemoteSigned -NoExit -File ${{ github.workspace }}\build\ps\Invoke-FortifyScan.ps1

build/ps/Invoke-BlackDuckDetect.ps1

@@ -0,0 +1,21 @@
+param(
+    $ProjectName = "EDI-FoundationLayer",
+    $ProjectVersionName = "1.0",
+    $SourcePath,
+    $BlackduckUrl = "https://blackduck.philips.com/",
+    $ApiToken = "OWFkOWM0NGMtM2FlMy00ODFiLThjMTctM2I1OTdkMTY2MTQ2OmNlMGI4NmNhLWRjMzAtNGU0Yy04NTIwLWEzZDI5NDFlNjdkMg==",
+    $ProxyHost = "apac.zscaler.philips.com",
+    $ProxyPort = "10015",
+    $ProxyIgnoreHosts = "blackduck.philips.com"
+
+)
+
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$detectScriptUrl = "https://detect.synopsys.com/detect.ps1"
+$detectScriptLocal = "$PSScriptRoot\detect.ps1"
+    
+Invoke-WebRequest -Uri $detectScriptUrl -Method Get -OutFile $detectScriptLocal
+
+Import-Module $detectScriptLocal 
+Detect --detect.project.name=$ProjectName --detect.project.version.name=$ProjectVersionName --detect.source.path=$SourcePath --blackduck.url=$BlackduckUrl --blackduck.trust.cert=true --blackduck.api.token=$ApiToken --blackduck.proxy.host=$ProxyHost --blackduck.proxy.port=$ProxyPort --blackduck.proxy.ignored.hosts=$ProxyIgnoreHosts --detect.blackduck.signature.scanner.individual.file.matching=ALL --detect.detector.search.depth=6

build/ps/Invoke-FortifyScan.ps1

@@ -0,0 +1,50 @@
+param(
+    $FortifyProjectId = "oauth2-proxy",
+    $FortifyVersionId = "Main",
+    $FortifyBuildId = "fortify_fl",
+    $FortifyFprPath = "$PSScriptRoot\$FortifyProjectId.$FortifyVersionId.fpr",
+    $PublishURL = "https://fortify.philips.com/ssc",
+    $PublishAuthToken = "785de478-dc2d-4829-959c-ea5cb8cd1adc",
+    $RepositoryRoot = "$PSScriptRoot\..\..\"
+)
+
+function Invoke-VswhereDownload (
+    [string]$Uri = "https://github.com/microsoft/vswhere/releases/download/2.8.4/vswhere.exe",
+    [string]$Outfile = "$PSScriptRoot\vswhere.exe"
+) {
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    Write-Output "downloading from '$Uri' to '$Outfile'"
+    Write-Output "please wait..."
+    Invoke-WebRequest -Uri $Uri -OutFile $Outfile
+}
+
+try {
+    $RepositoryRoot = [System.IO.Path]::GetFullPath($RepositoryRoot)
+
+    Invoke-VswhereDownload -Outfile "$PSScriptRoot\vswhere.exe"
+    & "$PSScriptRoot\vswhere.exe" -version 16.0 -property installationPath > "$PSScriptRoot\vswhereproductpath.txt"
+    $vspath = Get-Content -Path "$PSScriptRoot\vswhereproductpath.txt"
+    $env:Path = "$env:Path;$vspath\MSBuild\Current\Bin\"
+
+    & sourceanalyzer -b $FortifyBuildId -clean -logfile "$PSScriptRoot\fortify-clean.txt"
+    
+    & dotnet restore "$RepositoryRoot\contrib\oauth2-proxy_autocomplete.sln" -s "https://api.nuget.org/v3/index.json" --ignore-failed-sources
+
+    & dotnet restore "$RepositoryRoot\contrib\oauth2-proxy_autocomplete.sln"
+    & sourceanalyzer -b $FortifyBuildId msbuild.exe "$RepositoryRoot\contrib\oauth2-proxy_autocomplete.sln" /t:rebuild /p:Configuration=Release /p:Platform="Any CPU" /p:TreatWarningsAsErrors=false 
+
+    & sourceanalyzer -b $FortifyBuildId -Xmx8G -scan -f $FortifyFprPath -logfile "$PSScriptRoot\fortify-scan.txt"
+
+    #Upload fpr reports to fortify server
+
+    Write-Output "Uploading '$FortifyFprPath' of '$FortifyProjectId' with version '$FortifyVersionId' to '$PublishURL'"
+    & cmd /c fortifyclient.bat -url $PublishURL -authtoken $PublishAuthToken uploadFPR -file $FortifyFprPath -application $FortifyProjectId -applicationVersion "$FortifyVersionId"
+
+    Write-Output "Completed Fortify scan"
+}
+catch {
+    $ErrorMessage = $_.Exception.Message
+    Write-Error $ErrorMessage
+    Write-Output $ErrorMessage
+    exit -1
+}