Package: ghas-cli
ghas-cliCLI utility to interact withGitHub Advanced Security("GHAS").It allows to deploy GHAS features individually or at scale, while taking into account each repository configuration.More specifically, it automates the following:Ensure GitHub Actions are properly enabled for the repository (required for CodeQL),EnableSecret Scanner, and create an informative issueEnablePush Protection, and create an informative issueEnableDependabotand create an informative issueEnable theDependency Reviewerand create an informative issueOpen a PR to deployCode Scanningwith a custom configuration tuned for each repository's languages andnon-main default branch(e.gmainormasterare not hardcoded, it determines the proper default branch automatically),Cleanup legacy Mend issues on each repositoryEach of these actions can also open an issue explaining each feature, how to use them, and what to eventually do before they are fully enabled.
See./templatesto get an overview of these issues!To follow your deployment,ghas-clioutputs results in a csv file indicating the deployment status of each feature for each repository.You can work on a single repository or on thousands of them. In that case,ghas-clidoes its best to overcomeGitHub's rate limits...InstallationBuilds are available in theReleasestab.Pypi:pipinstallghas-cliManually:python-mpipinstall/full/path/to/ghas-cli-xxx.whl# e.g: python3 -m pip install Downloads/ghas-cli-0.5.0-none-any.whlUsageghas-cli -hor see thewiki.DevelopmentBuildInstall Poetryfirst, then:makedevBump the version numberBump the version number:poetry version x.x.xUpdate the__version__field insrc/cli.pyaccordingly.Publish a new versionRequiressyftto be installed to generate the sbom.Bump the version number as described abovemake depsto update the dependenciesmake releaseto build the packagesgit commit -a -S Bump to version 1.1.2andgit tag -s v1.1.2 -m "1.1.2"Uploaddist/*,checksums.sha512andchecksums.sha512.ascto a new release in GitHub.Upload toPyPi:poetry publish.Why not useghas-enablement?GitHub suggests usingghas-enablementto deploy GHAS at scale. Unfortunately, it has many limitations that make it a non viable tool as you understood if you read the beginning of this README, including:Only support for one default branch name: If you repositories are mixingmaster,main,dev,test... as the repository default branch, you will end up creating the CodeQL config to another branch than the default's.ghas-cliuses the correct default branch for each repo.Non per-language CodeQL workflow configuration: You can only automate the PR creation for a single CodeQL workflow config file. Your repositories are likely a mix of many languages combinations, so pushing a single workflow configuration accross an organization is not efficient.ghas-cliadjusts the CodeQL configuration to each repository languages.Doesn't check if Actions are properly enabled on your organization repositories: Runningghas-enablementwhen Actions are disabled will fail.ghas-climakes sure Actions are enabled before doing anything else. If they're not, it enables them.More broadly,ghas-clicreates more educative issues on each repositories. It also provides more flexibility with an extensive CLI to pipe in/out data.MiscellaneousThis repository is provided as-is and isn't bound to Malwarebytes' SLA.