Skip to content

Commit 2fa86a1

Browse files
apenlorapenlor
authored
ci(security): integrate multi-layered security scanning (#17)
* feat(api): generate OpenAPI specification for resource-server * build(security): integrate OWASP Dependency-Check plugin * chore(security): add OWASP ZAP baseline scan script * chore: ignore generated security reports * fix(deps): override Netty version to remediate CVE-2025-58056 * ci(security): integrate multi-layered security scanning pipeline * docs(readme): update README for phase 7 completion
1 parent 13c6c70 commit 2fa86a1

File tree

12 files changed

+449
-64
lines changed

12 files changed

+449
-64
lines changed

‎.dockerignore‎

Lines changed: 27 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,37 @@
1-
# Ignore Maven build output directories
2-
**/target
1+
# Git repository files
2+
.git/
3+
.gitignore
4+
.dockerignore
35

4-
# Ignore IDE-specific files
6+
# IDE-specific files
57
.idea/
68
*.iml
9+
.vscode/
710

8-
# Ignore build log files
9-
build.log
11+
# Maven wrapper (not used in our Docker build)
12+
mvnw
13+
mvnw.cmd
14+
.mvn/
1015

11-
# Ignore git repository files
12-
.git/
13-
.gitignore
16+
# Build output directories (handled by multi-stage build)
17+
**/target
1418

15-
# Ignore local environment files (the real one should never be in the image)
19+
# Local environment files (secrets should never be in the image)
1620
.env
1721

18-
# Ignore observability stack configs not needed in the app image
22+
# Generated security reports and data
23+
reports/
24+
dependency-check-data/
25+
26+
# Scripts used for orchestration, not for the application artifact
27+
scripts/
28+
29+
# Observability stack configs not needed in the app image
1930
config/
2031

21-
# Ignore persistent data volumes
22-
data/
32+
# Persistent data volumes
33+
data/
34+
35+
# Documentation and license files
36+
README.md
37+
LICENSE

‎.env.ci‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# ===================================================================
2+
# CI/CD TEST ENVIRONMENT VARIABLES
3+
# ===================================================================
4+
# This file provides the exact default values needed for the DAST
5+
# scan's subset of services (postgres, keycloak, resource-server) to initialize.
6+
# ===================================================================
7+
8+
# Actuator basic auth configuration
9+
ACTUATOR_USERNAME=actuator
10+
ACTUATOR_PASSWORD=actuator-password
11+
ACTUATOR_ROLES=ACTUATOR_ADMIN
12+
13+
# Keycloak Admin Credentials
14+
KC_BOOTSTRAP_ADMIN_USERNAME=admin
15+
KC_BOOTSTRAP_ADMIN_PASSWORD=admin
16+
17+
# PostgreSQL Credentials for Keycloak
18+
POSTGRES_DB=keycloak
19+
POSTGRES_USER=keycloak
20+
POSTGRES_PASSWORD=keycloak-password

‎.env.example‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@
77
# These variables will be used by docker-compose.yml to configure the services.
88
# ===================================================================
99

10-
# A secure, 256-bit (32-byte) or longer secret key for signing JWTs.
11-
# You can generate a new one using a command like: openssl rand -hex 32
12-
JWT_SECRET_KEY=replace-with-your-super-secret-and-long-key-for-hs256
13-
1410
# Actuator basic auth configuration
1511
ACTUATOR_USERNAME=actuator
1612
ACTUATOR_PASSWORD=actuator-password

‎.github/workflows/ci.yml‎

Lines changed: 84 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Java CI & Docker Build
1+
name: Java CI, Security Scans & Docker Build
22

33
# This workflow will run on pushes to the 'main' branch and on pull requests targeting 'main'
44
on:
@@ -9,34 +9,47 @@ on:
99

1010
jobs:
1111
build_and_test:
12-
name: Build & Test Application
12+
name: Build, Test & SCA Scan
1313
runs-on: ubuntu-latest
1414

15-
# Steps represent a sequence of tasks that will be executed as part of the job
1615
steps:
17-
1816
- name: Checkout repository
19-
uses: actions/checkout@v4
17+
# actions/checkout@v5.0.0
18+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
19+
20+
# Caching the NVD database is critical for performance. It will be restored on subsequent runs.
21+
- name: Cache OWASP Dependency-Check NVD
22+
# actions/cache@v4.2.4
23+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809
24+
with:
25+
path: ~/.m2/repository/org/owasp/dependency-check-data
26+
# The key invalidates the cache if a pom.xml file changes.
27+
key: ${{ runner.os }}-dependency-check-${{ hashFiles('**/pom.xml') }}
28+
restore-keys: |
29+
${{ runner.os }}-dependency-check-
2030
2131
- name: Set up JDK 21
22-
uses: actions/setup-java@v4
32+
# actions/setup-java@v5.0.0
33+
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165
2334
with:
2435
java-version: '21'
2536
distribution: 'temurin'
37+
cache: maven
2638

27-
# The build will fail if any tests fail, blocking the PR from merging.
28-
- name: Build and test with Maven
39+
# The 'verify' lifecycle phase automatically triggers the dependency-check plugin.
40+
# The build will fail if any high-severity CVEs are found.
41+
- name: Build, Test, and Scan Dependencies with Maven
2942
run: ./mvnw -B clean verify
3043

31-
build_docker_image:
32-
name: Build Docker Image
33-
# This job will only run if the 'build_and_test' job succeeds.
44+
build_and_scan_images:
45+
name: Build & Scan Docker Images
3446
needs: build_and_test
3547
runs-on: ubuntu-latest
3648

3749
steps:
3850
- name: Checkout repository
39-
uses: actions/checkout@v4
51+
# actions/checkout@v5.0.0
52+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
4053

4154
- name: Set up QEMU
4255
# docker/setup-qemu-action@v3.6.0
@@ -46,12 +59,67 @@ jobs:
4659
# docker/setup-buildx-action@v3.11.1
4760
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
4861

49-
- name: Build the Docker image
50-
# This command proves that our Dockerfile is valid and can be built.
51-
# We don't push the image in this CI workflow, as that is a CD (Continuous Deployment) task.
62+
- name: Build resource-server image
5263
run: |
5364
docker buildx build \
5465
--platform linux/amd64 \
66+
--load \
5567
-t security-lab/resource-server:ci-build \
5668
-f ./resource-server/Dockerfile \
57-
.
69+
.
70+
71+
- name: Scan resource-server image with Trivy
72+
# aquasecurity/trivy-action@0.33.1
73+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
74+
with:
75+
image-ref: 'security-lab/resource-server:ci-build'
76+
format: 'table'
77+
exit-code: '1'
78+
ignore-unfixed: true
79+
vuln-type: 'os,library'
80+
severity: 'CRITICAL,HIGH'
81+
82+
- name: Build web-client image
83+
run: |
84+
docker buildx build \
85+
--platform linux/amd64 \
86+
--load \
87+
-t security-lab/web-client:ci-build \
88+
-f ./web-client/Dockerfile \
89+
.
90+
91+
- name: Scan web-client image with Trivy
92+
# aquasecurity/trivy-action@0.33.1
93+
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
94+
with:
95+
image-ref: 'security-lab/web-client:ci-build'
96+
format: 'table'
97+
exit-code: '1'
98+
ignore-unfixed: true
99+
vuln-type: 'os,library'
100+
severity: 'CRITICAL,HIGH'
101+
102+
security_scan_dast:
103+
name: DAST Scan with OWASP ZAP
104+
needs: build_and_test
105+
runs-on: ubuntu-latest
106+
107+
steps:
108+
- name: Checkout repository
109+
# actions/checkout@v5.0.0
110+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
111+
112+
- name: Make scan script executable
113+
run: chmod +x scripts/run-zap-scan.sh
114+
115+
- name: Run DAST scan script
116+
run: ./scripts/run-zap-scan.sh
117+
118+
# This step will run even if the DAST scan fails, ensuring the report is always available.
119+
- name: Upload DAST Scan Report
120+
if: always()
121+
# actions/upload-artifact@v4.6.2
122+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
123+
with:
124+
name: dast-scan-report
125+
path: reports/

‎.gitignore‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,13 @@ Thumbs.db
4343
ehthumbs.db
4444
Desktop.ini
4545

46-
### Security & Reports ###
47-
# ZAP reports directory
48-
reports/
49-
50-
# OWASP Dependency-Check reports
51-
dependency-check-report.*
52-
46+
### Lab Specific ###
5347
# Local environment variables
5448
.env
5549

5650
# Persistent data volumes
57-
/data/
51+
/data/
52+
53+
# Generated Security Reports & Data
54+
reports/
55+
dependency-check-data/

0 commit comments

Comments
 (0)