SecYourIT
Tags: actionshackathon21, devops, actionshackathon, opensource
Published: 2021-12-07 19:10:34

[Instructions]: # (To submit to the GitHub Actions x DEV Hackathon 2021, please fill out all sections.)

### Inspiration
Being an LFX Mentee at Kyverno this quarter, I was looking after and enchancing their Security Processes and their CI mechanisms. That is when I was exposed to the world of DevSecOps. I remember copying down the same actions multiple times. Fast forward to a month and here I am in this Github Action x DEV Hackathon 2021 where I am solving this problem so that nobody faces this again.

### My Workflow
I introduce y'all to SecYourIT (read: sec-your-it-e), a 5-in-one DevSecOps reusable GitHub workflow that takes care of your project's security in the CI itself thanks to Github Actions. You can customise it based on the language of your project as it supports more than 20 languages.
It handles the following components of your project:
- Sensitive Token Exposure [Check for Tokens or Keys being pushed]
- Commit Authenticity Verification [Verify Commits]
- Dependency Scanning [Scan for vulnerabilities in Dependencies]
- SCA [Software Composition Analysis],
- SAST [Static Application Security Testing]

Check out {% github shubhampalriwala/secyourit %}

### Submission Category: 
Maintainer Must-Haves
DIY Deployments

### Yaml File or Link to Code
```yaml
name: secyourit
on:
  workflow_call:
    inputs:
      signerID:
        required: false
        type: string
      org:
        required: false
        type: string
      path:
        required: true
        type: string
      language:
        required: true
        type: string
    secrets:
      SNYK_API_TOKEN:
        required: true

jobs:
  hola-secyourit:
    name: "Welcome to SecyourIT"
    runs-on: ubuntu-latest
    steps:
      - name: Project Init
        run: echo "SecyourIT says Hi!"
  
  find-secrets:
    name: 'Scan for Secrets'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Find Secrets
        uses: max/secret-scan@master
        with:
          exclude_path: '.github/workflows/configuration/exclude_paths.txt'
  
  verify-commits-using-notary:
    name: Verify Commits using Notary
    runs-on: ubuntu-latest
    steps:
      - uses: vchain-us/verify-action@master
        with:
          signerID: ${{inputs.signerID}}
          org: ${{inputs.org}}
          path: ${{inputs.path}}

  scan-image-using-trivy:
    name: Trivy Scan Image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Scan File system suing Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM'

  sca-using-snyk:
    name: Software Compositon Analysis using Snyk
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/${{inputs.language}}@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_API_TOKEN }}

  sast-using-appthreat:
    name: SAST using AppThreat
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Run SAST Scan by AppThreat
        uses: AppThreat/sast-scan-action@master
        with:
          type: ${{inputs.language}}
```

### Additional Resources / Info

[Github URL](https://github.com/ShubhamPalriwala/secyourit)

[Figma Project Link](https://www.figma.com/file/GtVvanvVW1bPjJqiffqOvw/SecYourIT?node-id=0%3A1)

Open Source Projects that are being used in my workflow:
- [Max/Secret-Scan](https://github.com/marketplace/actions/secret-scan) to scan for tokens and sensitive date
- [VChain-US/Verify-Action](https://github.com/vchain-us/verify-action) to verify the authenticity of the commits
- [AquaSecurity/Trivy-Action](https://github.com/aquasecurity/trivy-action) to scan the file system and the dependencies for vulnerabilities
- [Snyk/Actions](https://github.com/snyk/actions) to perform Software Composition Analysis
- [AppThreat/sast-scan-action](https://github.com/AppThreat/sast-scan) to perform Static Application Security Testing