Adding ReversingLabs workflow

.github/actions/rl-scanner/action.yml

@@ -0,0 +1,73 @@
+
+name: 'RL-Security-Scanner'
+description: 'Runs the Reversing Labs scanner on a specified artifact.'
+inputs:
+  artifact-path:
+    description: 'Path to the artifact to be scanned.'
+    required: true
+  version:
+    description: 'Version of the artifact.'
+    required: true
+
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.10'
+
+    - name: Install Python dependencies
+      shell: bash
+      run: |
+        pip install boto3 requests
+
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v1
+      with:
+        role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
+        aws-region: 'us-east-1'
+        mask-aws-account-id: true
+
+    - name: Install RL Wrapper
+      shell: bash
+      run: |
+        pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
+
+    - name: Run RL Scanner
+      shell: bash
+      env:
+        RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
+        RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
+        SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
+        PYTHONUNBUFFERED: 1
+      run: |
+        if [ ! -f "${{ inputs.artifact-path }}" ]; then
+          echo "Artifact not found: ${{ inputs.artifact-path }}"
+          exit 1
+        fi
+
+        rl-wrapper \
+          --artifact "${{ inputs.artifact-path }}" \
+          --version "${{ inputs.version }}" \
+          --name "${{ github.event.repository.name }}" \
+          --repository "${{ github.repository }}" \
+          --commit "${{ github.sha }}" \
+          --build-env "github_actions" \
+          --suppress_output
+
+        # Check the outcome of the scanner
+        if [ $? -ne 0 ]; then
+          echo "RL Scanner failed."
+          echo "scan-status=failed" >> $GITHUB_ENV
+          exit 1
+        else
+          echo "RL Scanner passed."
+          echo "scan-status=success" >> $GITHUB_ENV
+        fi
+
+outputs:
+    scan-status:
+        description: 'The outcome of the scan process.'
+        value: ${{ env.scan-status }}

.github/workflows/main.yml

@@ -18,16 +18,9 @@ env:
     java: 11
 
 jobs:
-    authorize:
-      name: Authorize
-      environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
-      runs-on: ubuntu-latest
-      steps:
-        - run: true
 
     analyze-auth0_flutter:
         name: Analyze auth0_flutter Flutter package
-        needs: authorize
         runs-on: ubuntu-latest
 
         steps:
@@ -51,7 +44,6 @@ jobs:
 
     analyze-auth0_flutter_platform_interface:
         name: Analyze auth0_flutter_platform_interface Flutter package
-        needs: authorize
         runs-on: ubuntu-latest
 
         steps:
@@ -71,7 +63,6 @@ jobs:
 
     test-auth0_flutter:
         name: Test auth0_flutter Flutter package
-        needs: authorize
         runs-on: ubuntu-latest
 
         steps:
@@ -103,7 +94,6 @@ jobs:
 
     test-auth0_flutter_platform_interface:
         name: Test auth0_flutter_platform_interface Flutter package
-        needs: authorize
         runs-on: ubuntu-latest
 
         steps:
@@ -129,7 +119,6 @@ jobs:
 
     test-ios-unit:
         name: Run native iOS unit tests using Xcode ${{ matrix.xcode }}
-        needs: authorize
         runs-on: macos-13
         environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
 
@@ -172,7 +161,6 @@ jobs:
 
     test-ios-smoke:
         name: Run native iOS smoke tests using Xcode ${{ matrix.xcode }}
-        needs: authorize
         runs-on: macos-13-large
         environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
 
@@ -207,7 +195,6 @@ jobs:
 
     test-macos-unit:
         name: Run native macOS unit tests using Xcode ${{ matrix.xcode }}
-        needs: authorize
         runs-on: macos-13
         environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
 
@@ -244,7 +231,6 @@ jobs:
 
     test-macos-smoke:
         name: Run native macOS smoke tests using Xcode ${{ matrix.xcode }}
-        needs: authorize
         runs-on: macos-13
         environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
 
@@ -279,7 +265,6 @@ jobs:
 
     test-android-unit:
         name: Run native Android unit tests
-        needs: authorize
         runs-on: ubuntu-latest
         environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
 
@@ -318,7 +303,6 @@ jobs:
 
     # test-android-smoke:
     #     name: Run native Android smoke tests using API-level ${{ matrix.android-api }}
-    #     needs: authorize
     #     runs-on: macos-latest-xl
     #     environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
 

.github/workflows/publish-af.yml

@@ -5,13 +5,31 @@ on:
     tags:
       - 'af-v[0-9]+.[0-9]+.[0-9]+*'
 
+permissions:
+  contents: write
+  id-token: write
+
 env:
   flutter: '3.x'
 
 jobs:
+  rl-scanner:
+    uses: ./.github/workflows/rl-scanner.yml
+    with:
+      flutter: '3.x'
+      artifact-name: 'auth0-flutter-af.zip'
+    secrets:
+      RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
+      RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
+      SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+      PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
+      PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
+      PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+
   publish:
     name: Publish auth0_flutter to pub.dev
     environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
+    needs: rl-scanner
     runs-on: ubuntu-latest
 
     permissions:

.github/workflows/publish-afpi.yml

@@ -5,13 +5,31 @@ on:
     tags:
       - 'afpi-v[0-9]+.[0-9]+.[0-9]+*'
 
+permissions:
+  contents: write
+  id-token: write
+
 env:
   flutter: '3.x'
 
 jobs:
+  rl-scanner:
+    uses: ./.github/workflows/rl-scanner.yml
+    with:
+      flutter: '3.x'
+      artifact-name: 'auth0-flutter-afpi.zip'
+    secrets:
+      RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
+      RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
+      SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+      PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
+      PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
+      PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+
   publish:
     name: Publish auth0_flutter_platform_interface to pub.dev
     environment: ${{ github.event.pull_request.head.repo.fork && 'external' || 'internal' }}
+    needs: rl-scanner
     runs-on: ubuntu-latest
 
     permissions:

.github/workflows/rl-scanner.yml

@@ -0,0 +1,76 @@
+name: RL-Secure-Workflow
+
+on:
+  workflow_call:
+    inputs:
+      flutter:
+        required: true
+        type: string
+      artifact-name:
+        required: true
+        type: string
+    secrets:
+      RLSECURE_LICENSE:
+        required: true
+      RLSECURE_SITE_KEY:
+        required: true
+      SIGNAL_HANDLER_TOKEN:
+        required: true
+      PRODSEC_TOOLS_USER:
+        required: true
+      PRODSEC_TOOLS_TOKEN:
+        required: true
+      PRODSEC_TOOLS_ARN:
+        required: true
+
+
+
+jobs:
+  rl-scanner:
+    name: Run Reversing Labs Scanner
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
+    runs-on: ubuntu-latest
+    outputs:
+      scan-status: ${{ steps.rl-scan-conclusion.outcome }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }}
+
+      - name: Set up Flutter
+        uses: subosito/flutter-action@2783a3f08e1baf891508463f8c6653c258246225
+        with:
+          flutter-version: ${{ inputs.flutter }}
+          channel: stable
+          cache: true
+
+      - name: Build package
+        shell: bash
+        run: |
+          zip -r ${{ inputs.artifact-name }} ./*
+
+      - name: Get Artifact Version
+        id: get_version
+        run: |
+          version=$(awk -F"'" '/const String version/ {print $2}' auth0_flutter/lib/src/version.dart)
+          echo "version=$version" >> $GITHUB_OUTPUT
+
+
+      - name: Run Reversing Labs Scanner
+        id: rl-scan-conclusion
+        uses: ./.github/actions/rl-scanner
+        with:
+          artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
+          version: "${{ steps.get_version.outputs.version }}"
+        env:
+          RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
+          RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
+          SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+          PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
+          PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
+          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+
+      - name: Output scan result
+        run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV