Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dependency check github workflow configuration #2659

Merged
merged 11 commits into from
Aug 10, 2023

Conversation

Rkareko
Copy link
Contributor

@Rkareko Rkareko commented Aug 9, 2023

IMPORTANT: Where possible all PRs must be linked to a Github issue

Fixes #[issue number] or Closes #[issue number]

The branch that the
SCA scan automation using Dependency Check PR by @bonfaceshisakha was based has diverged significantly from main.
This PR applies the same changes based on the latest main branch.

Tasks

  • Fix generation of dependency check report in xml format
  • Upload dependency check report to defectdojo

Engineer Checklist

  • I have written Unit tests for any new feature(s) and edge cases for bug fixes
  • I have added any strings visible on UI components to the strings.xml file
  • I have updated the CHANGELOG.md file for any notable changes to the codebase
  • I have run ./gradlew spotlessApply and ./gradlew spotlessCheck to check my code follows the project's style guide
  • I have built and run the FHIRCore app to verify my change fixes the issue and/or does not break the app
  • I have checked that this PR does NOT introduce breaking changes that require an update to Content and/or Configs? If it does add a sample here or a link to exactly what changes need to be made to the content.

Code Reviewer Checklist

  • I have verified Unit tests have been written for any new feature(s) and edge cases
  • I have verified any strings visible on UI components are in the strings.xml file
  • I have verifed the CHANGELOG.md file has any notable changes to the codebase
  • I have verified the solution has been implemented in a configurable and generic way for reuseable components
  • I have built and run the FHIRCore app to verify the change fixes the issue and/or does not break the app

@Rkareko Rkareko marked this pull request as draft August 9, 2023 04:29
@codecov
Copy link

codecov bot commented Aug 9, 2023

Codecov Report

Merging #2659 (764db4e) into main (ad3a737) will increase coverage by 0.4%.
Report is 14 commits behind head on main.
The diff coverage is 69.9%.

Impacted file tree graph

@@            Coverage Diff            @@
##              main   #2659     +/-   ##
=========================================
+ Coverage     64.5%   65.0%   +0.4%     
- Complexity    1075    1085     +10     
=========================================
  Files          218     220      +2     
  Lines         9635    9723     +88     
  Branches      1897    1916     +19     
=========================================
+ Hits          6218    6322    +104     
+ Misses        2234    2186     -48     
- Partials      1183    1215     +32     
Flag Coverage Δ
engine 72.7% <80.6%> (+<0.1%) ⬆️
geowidget 65.3% <20.0%> (+1.0%) ⬆️
quest 59.6% <66.6%> (+0.7%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed Coverage Δ
...rcore/engine/util/extension/BigDecimalExtension.kt 0.0% <0.0%> (ø)
...quest/ui/report/measure/MeasureReportMainScreen.kt 0.0% <0.0%> (ø)
...rt/measure/models/MeasureReportPopulationResult.kt 25.0% <0.0%> (-12.5%) ⬇️
...fhircore/quest/ui/appsetting/AppSettingActivity.kt 42.8% <14.2%> (-5.6%) ⬇️
...er/fhircore/geowidget/screens/GeoWidgetFragment.kt 36.6% <20.0%> (+2.4%) ⬆️
.../quest/ui/report/measure/MeasureReportViewModel.kt 54.7% <45.4%> (-0.8%) ⬇️
...re/quest/ui/questionnaire/QuestionnaireActivity.kt 29.3% <50.0%> (+0.9%) ⬆️
...re/components/MeasureReportPopulationResultView.kt 76.1% <50.0%> (+0.5%) ⬆️
...hircore/engine/util/extension/MeasureExtensions.kt 48.7% <57.1%> (+1.6%) ⬆️
.../report/measure/screens/MeasureReportListScreen.kt 53.8% <59.0%> (+53.8%) ⬆️
... and 11 more

... and 2 files with indirect coverage changes

@Rkareko
Copy link
Contributor Author

Rkareko commented Aug 9, 2023

@bonfaceshisakha The pending bit is uploading the dependency check report to defectdojo

env:
FHIR_BASE_URL: ${{secrets.FHIR_BASE_URL}}
OAUTH_BASE_URL: ${{secrets.OAUTH_BASE_URL}}
OAUTH_CIENT_ID: ${{secrets.OAUTH_CIENT_ID}}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fix typo , change to ${{secrets.OAUTH_CIENT_ID}}

curl -X POST -H "Content-Type: application/json" \
-H "Authorization: Token ${DEFECTDOJO_API_KEY}" \
-d @android/build/reports/dependency-check-report.xml \
"${DEFECTDOJO_API_URL}/api/v2/engagements/45/tests/247/import-scan/"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bonfaceshisakha Kindly verify the url params for defectdojo

@ellykits ellykits marked this pull request as ready for review August 10, 2023 11:38
@ellykits ellykits merged commit 5be4690 into main Aug 10, 2023
7 checks passed
@ellykits ellykits deleted the security-automation-additions-latest-main branch August 10, 2023 13:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants