mvp
This commit is contained in:
28
README.md
28
README.md
@@ -1,2 +1,30 @@
|
||||
# tas-actions
|
||||
|
||||
Reusable GitHub Actions for [TAS (Tea Advanced Security)](https://github.com/go-gitea/gitea): upload SARIF reports and gate CI on the API response.
|
||||
|
||||
## Actions
|
||||
|
||||
### [tas-upload-sarif](tas-upload-sarif/)
|
||||
|
||||
Uploads a SARIF report from a file to TAS and **fails the job** if the API returns `allowed: false`.
|
||||
|
||||
**Example workflow** (e.g. after a security scan that produces SARIF):
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
scan:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
# Run your scanner and produce SARIF (e.g. to results.sarif)
|
||||
# - run: ./run-scanner --output results.sarif
|
||||
|
||||
- name: Upload SARIF to TAS and gate
|
||||
uses: your-org/tas-actions/tas-upload-sarif@v1
|
||||
with:
|
||||
tas-base-url: 'https://tas.example.com'
|
||||
sarif-file: 'results.sarif'
|
||||
```
|
||||
|
||||
See [tas-upload-sarif/README.md](tas-upload-sarif/README.md) for all inputs and options.
|
||||
131
openapi.json
Normal file
131
openapi.json
Normal file
@@ -0,0 +1,131 @@
|
||||
{
|
||||
"openapi": "3.1.0",
|
||||
"info": {
|
||||
"title": "TAS — Tea Advanced Security",
|
||||
"description": "Security reporting and gating API for Gitea. Upload SARIF reports per repo/branch; get allowed/new_findings for CI gating.",
|
||||
"version": "1.0.0"
|
||||
},
|
||||
"servers": [{ "url": "http://localhost:3000", "description": "Local" }],
|
||||
"paths": {
|
||||
"/repos/{owner}/{repo}/branches/{branch}/reports": {
|
||||
"post": {
|
||||
"operationId": "postReposByOwnerByRepoBranchesByBranchReports",
|
||||
"description": "Upload a SARIF report for a repository and branch. Replaces any existing report. On non-default branches, compares to baseline and returns allowed/new_findings for CI gating.",
|
||||
"request": {
|
||||
"params": {
|
||||
"owner": {
|
||||
"description": "Repository owner (e.g. t.behrendt)",
|
||||
"required": true
|
||||
},
|
||||
"repo": {
|
||||
"description": "Repository name (e.g. k_gitea)",
|
||||
"required": true
|
||||
},
|
||||
"branch": { "description": "Branch name", "required": true }
|
||||
},
|
||||
"body": {
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"description": "SARIF 2.1 document with runs[]"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "Report stored and (for non-default branch) gating result",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"allowed": { "type": "boolean" },
|
||||
"reason": { "type": "string" },
|
||||
"new_critical": { "type": "number" },
|
||||
"new_high": { "type": "number" },
|
||||
"new_medium": { "type": "number" },
|
||||
"new_low": { "type": "number" },
|
||||
"new_findings": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"rule_id": { "type": "string" },
|
||||
"level": { "type": "string" },
|
||||
"message": { "type": "string" },
|
||||
"severity": {
|
||||
"type": "string",
|
||||
"enum": ["CRITICAL", "HIGH", "MEDIUM", "LOW"]
|
||||
},
|
||||
"artifact_uri": { "type": "string" },
|
||||
"region": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"start_line": {
|
||||
"anyOf": [
|
||||
{ "type": "number" },
|
||||
{ "type": "null" }
|
||||
]
|
||||
},
|
||||
"start_column": {
|
||||
"anyOf": [
|
||||
{ "type": "number" },
|
||||
{ "type": "null" }
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": ["start_line", "start_column"]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"rule_id",
|
||||
"level",
|
||||
"message",
|
||||
"severity",
|
||||
"artifact_uri",
|
||||
"region"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"allowed",
|
||||
"new_critical",
|
||||
"new_high",
|
||||
"new_medium",
|
||||
"new_low",
|
||||
"new_findings"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"parameters": [
|
||||
{
|
||||
"schema": { "type": "string" },
|
||||
"in": "path",
|
||||
"name": "owner",
|
||||
"required": true
|
||||
},
|
||||
{
|
||||
"schema": { "type": "string" },
|
||||
"in": "path",
|
||||
"name": "repo",
|
||||
"required": true
|
||||
},
|
||||
{
|
||||
"schema": { "type": "string" },
|
||||
"in": "path",
|
||||
"name": "branch",
|
||||
"required": true
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"components": {}
|
||||
}
|
||||
48
tas-upload-sarif/README.md
Normal file
48
tas-upload-sarif/README.md
Normal file
@@ -0,0 +1,48 @@
|
||||
# TAS Upload SARIF
|
||||
|
||||
Reusable GitHub Action that uploads a SARIF report to [TAS (Tea Advanced Security)](https://github.com/go-gitea/gitea) and **fails the job** if the API responds with `allowed: false` (e.g. new findings above your policy).
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| `tas-base-url` | Yes | Base URL of the TAS API (e.g. `https://tas.example.com`) |
|
||||
| `sarif-file` | Yes | Path to the SARIF report file (JSON) |
|
||||
| `owner` | No | Repository owner (default: `github.repository_owner`) |
|
||||
| `repo` | No | Repository name (default: `github.event.repository.name`) |
|
||||
| `branch` | No | Branch name (default: `github.ref_name`) |
|
||||
|
||||
## Usage
|
||||
|
||||
```yaml
|
||||
- name: Upload SARIF to TAS and gate
|
||||
uses: your-org/tas-actions/tas-upload-sarif@v1
|
||||
with:
|
||||
tas-base-url: 'https://tas.example.com'
|
||||
sarif-file: 'results.sarif'
|
||||
```
|
||||
|
||||
With explicit owner/repo/branch (e.g. for monorepos or custom refs):
|
||||
|
||||
```yaml
|
||||
- uses: your-org/tas-actions/tas-upload-sarif@v1
|
||||
with:
|
||||
tas-base-url: ${{ vars.TAS_BASE_URL }}
|
||||
sarif-file: 'scan-output.sarif'
|
||||
owner: my-org
|
||||
repo: my-repo
|
||||
branch: ${{ github.head_ref }}
|
||||
```
|
||||
|
||||
## Behavior
|
||||
|
||||
1. **POST**s the SARIF file to `{tas-base-url}/repos/{owner}/{repo}/branches/{branch}/reports`.
|
||||
2. On HTTP non-200, the step fails and prints the response body.
|
||||
3. On success, reads the JSON response:
|
||||
- If `allowed` is `true`, the step succeeds.
|
||||
- If `allowed` is `false`, the step **fails** and prints `reason` and the full response (e.g. `new_critical`, `new_high`, `new_findings`).
|
||||
|
||||
## Requirements
|
||||
|
||||
- **GitHub-hosted runners**: `curl` and `jq` are available by default.
|
||||
- **Self-hosted runners**: ensure `curl` and `jq` are installed.
|
||||
66
tas-upload-sarif/action.yml
Normal file
66
tas-upload-sarif/action.yml
Normal file
@@ -0,0 +1,66 @@
|
||||
name: 'TAS Upload SARIF'
|
||||
description: 'Upload a SARIF report to TAS (Tea Advanced Security) and fail the job if gating returns allowed: false'
|
||||
inputs:
|
||||
tas-base-url:
|
||||
description: 'Base URL of the TAS API (e.g. https://tas.example.com)'
|
||||
required: true
|
||||
sarif-file:
|
||||
description: 'Path to the SARIF report file (JSON)'
|
||||
required: true
|
||||
owner:
|
||||
description: 'Repository owner (default: GitHub repository owner)'
|
||||
required: false
|
||||
repo:
|
||||
description: 'Repository name (default: GitHub repository name)'
|
||||
required: false
|
||||
branch:
|
||||
description: 'Branch name (default: current ref name, e.g. main)'
|
||||
required: false
|
||||
runs:
|
||||
using: 'composite'
|
||||
steps:
|
||||
- name: Upload SARIF to TAS and gate
|
||||
shell: bash
|
||||
env:
|
||||
OWNER: ${{ inputs.owner || github.repository_owner }}
|
||||
REPO: ${{ inputs.repo || github.event.repository.name }}
|
||||
BRANCH: ${{ inputs.branch || github.ref_name }}
|
||||
BASE_URL: ${{ inputs.tas-base-url }}
|
||||
SARIF_FILE: ${{ inputs.sarif-file }}
|
||||
run: |
|
||||
BASE_URL="${BASE_URL%/}"
|
||||
URL="${BASE_URL}/repos/${OWNER}/${REPO}/branches/${BRANCH}/reports"
|
||||
echo "Uploading SARIF to TAS: $URL"
|
||||
|
||||
if [[ ! -f "$SARIF_FILE" ]]; then
|
||||
echo "::error::SARIF file not found: $SARIF_FILE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "$URL" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d @"$SARIF_FILE")
|
||||
|
||||
HTTP_BODY=$(echo "$RESPONSE" | head -n -1)
|
||||
HTTP_CODE=$(echo "$RESPONSE" | tail -n 1)
|
||||
|
||||
if [[ "$HTTP_CODE" != "200" ]]; then
|
||||
echo "::error::TAS API returned HTTP $HTTP_CODE"
|
||||
echo "$HTTP_BODY" | head -20
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ALLOWED=$(echo "$HTTP_BODY" | jq -r '.allowed')
|
||||
REASON=$(echo "$HTTP_BODY" | jq -r '.reason // empty')
|
||||
|
||||
if [[ "$ALLOWED" != "true" ]]; then
|
||||
echo "::error::TAS gating failed (allowed: false). $REASON"
|
||||
echo "::error::new_critical/new_high/new_medium/new_low are in the API response."
|
||||
echo "$HTTP_BODY" | jq '.'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "TAS gating passed (allowed: true)."
|
||||
if [[ -n "$REASON" ]]; then
|
||||
echo "$REASON"
|
||||
fi
|
||||
Reference in New Issue
Block a user