diff --git a/docker/pipeline-jobs/docker-compose-test.yml b/docker/pipeline-jobs/docker-compose-test.yml new file mode 100644 index 0000000000000000000000000000000000000000..8d182cf9d9e2a60c141442ec75fe93a94de5c4dc --- /dev/null +++ b/docker/pipeline-jobs/docker-compose-test.yml @@ -0,0 +1,15 @@ +services: + + <<pipelineJobName>>: + image: registry1.dso.mil/ironbank/opensource/trufflehog/trufflehog3:3.0.10 + container_name: <<pipelineJobName>> + entrypoint: ["${BASE_SCRIPTS_DIR}/trufflehog/entrypoint.sh"] + working_dir: /root + environment: + - REPORTS_DIR=${BASE_REPORTS_DIR}/<<pipelineJobName>> + - SCRIPTS_DIR=${BASE_SCRIPTS_DIR}/trufflehog + - SCAN_DIR=/app + - TRUFFLEHOG_EXCLUDE_PATHS=<<exclusions>> + volumes: + - ./:/root + - ./<<projectName>>-<<subProjectName>>:/app \ No newline at end of file diff --git a/docker/pipeline-jobs/docker-compose-trufflehog.yml b/docker/pipeline-jobs/docker-compose-trufflehog.yml new file mode 100644 index 0000000000000000000000000000000000000000..b483471f11cd8cd24ec7563f69874c2790bb1f2b --- /dev/null +++ b/docker/pipeline-jobs/docker-compose-trufflehog.yml @@ -0,0 +1,15 @@ +services: + + <<pipelineJobName>>: + image: registry1.dso.mil/ironbank/opensource/trufflehog/trufflehog3:3.0.10 + container_name: <<pipelineJobName>> + entrypoint: ["${BASE_SCRIPTS_DIR}/trufflehog/entrypoint.sh"] + working_dir: /root + environment: + - REPORTS_DIR=${BASE_REPORTS_DIR}/<<pipelineJobName>> + - SCRIPTS_DIR=${BASE_SCRIPTS_DIR}/trufflehog + - SCAN_DIR=/app + - TRUFFLEHOG_EXCLUDE_PATHS=<<exclusions>> + volumes: + - ./:/root + - ./<<projectName>>-<<subProjectName>>:/app diff --git a/formulas/express.yml b/formulas/express.yml new file mode 100644 index 0000000000000000000000000000000000000000..1d136fb8a1f75289ecfd9373cb3053aac0b5a209 --- /dev/null +++ b/formulas/express.yml @@ -0,0 +1,13 @@ +pipelineJobs: + - name: trufflehog + composeFile: docker/pipeline-jobs/docker-compose-trufflehog.yml + substitutions: + pipelineJobName: trufflehog-api + subProjectName: api + exclusions: package-lock.json + - name: fakeTestJob + composeFile: docker/pipeline-jobs/docker-compose-test.yml + substitutions: + pipelineJobName: trufflehog-test + subProjectName: test + exclusions: testfile.yml diff --git a/root/.env b/root/.env index c39988a08363e537aafcb30d1a148f58cca55ebb..aac15652d8510bc35a9297995fa5c8ecc2fc0fb7 100644 --- a/root/.env +++ b/root/.env @@ -1 +1,3 @@ DEBUGGER_ARGS=--continue +BASE_REPORTS_DIR=reports +BASE_SCRIPTS_DIR=scripts diff --git a/scripts/trufflehog/docker-compose.yml b/scripts/trufflehog/docker-compose.yml deleted file mode 100644 index 572193b55468ac5c4e7636db93876e8e2e69af36..0000000000000000000000000000000000000000 --- a/scripts/trufflehog/docker-compose.yml +++ /dev/null @@ -1,34 +0,0 @@ -version: "0.1" -services: - - trufflehog-api: - image: registry1.dso.mil/ironbank/opensource/trufflehog/trufflehog3:3.0.10 - container_name: trufflehog3-api - entrypoint: ["/root/scripts/trufflehog/entrypoint.sh"] - working_dir: /root - # env_file: - # - .env # TODO: Setting env vars in here allows use of env vars inside this file itself, i.e. the entrypoint directory. Probably good to define a BASE_SCRIPTS_DIR for all jobs. - environment: - - REPORT_DIR=/root/reports/trufflehog-api - - SCRIPTS_DIR=/root/scripts/trufflehog - - SCAN_DIR=/app - # - TRUFFLEHOG_EXCLUDE_PATHS= # TODO: Refine - volumes: - - ./:/root - - ./<<projectName>>-api:/app - - trufflehog-ui: - image: registry1.dso.mil/ironbank/opensource/trufflehog/trufflehog3:3.0.10 - container_name: trufflehog3-ui - entrypoint: ["/root/scripts/trufflehog/entrypoint.sh"] - working_dir: /root - # env_file: - # - .env # TODO: Setting env vars in here allows use of env vars inside this file itself, i.e. the entrypoint directory. Probably good to define a BASE_SCRIPTS_DIR for all jobs. - environment: - - REPORT_DIR=/root/reports/trufflehog-ui - - SCRIPTS_DIR=/root/scripts/trufflehog - - SCAN_DIR=/app - # - TRUFFLEHOG_EXCLUDE_PATHS= # TODO: Refine - volumes: - - ./:/root - - ./<<projectName>>-ui:/app diff --git a/scripts/trufflehog/entrypoint.sh b/scripts/trufflehog/entrypoint.sh index 847f71992bb7551ea981d2193196345936ffc612..a6cfd0a643d92e529e57f63fda97f4ee961501ea 100755 --- a/scripts/trufflehog/entrypoint.sh +++ b/scripts/trufflehog/entrypoint.sh @@ -1,19 +1,16 @@ #!/bin/bash -ls -al # TODO: Delete -mkdir -p ${REPORT_DIR} -REPORT_FILE=${REPORT_DIR}/trufflehog_report.json +mkdir -p ${REPORTS_DIR} +REPORT_FILE=${REPORTS_DIR}/trufflehog_report.json # enable shell globbing for recursive exclude matching. allows use of '**/*' format shopt -s globstar -configfiletoremove=".trufflehog3.yml" -if [ -f "$configfiletoremove" ]; then rm -f "$configfiletoremove" && echo "I deleted trufflehog3.yml"; fi # set -x so we can see the real command being run set -x -trufflehog3 -vvv --ignore-nosecret --exclude ${TRUFFLEHOG_EXCLUDE_PATHS} \ - --format json --zero --no-history \ +trufflehog3 -vvv --ignore-nosecret --format json --zero --no-history \ + --exclude ${TRUFFLEHOG_EXCLUDE_PATHS} \ -r ${SCRIPTS_DIR}/rules.yml \ - -o ${REPORT_FILE} ${SCAN_DIR} 2>&1 | tee ${REPORT_DIR}/trufflehog_log.txt # TODO: Writing to trufflehog_log.txt not currently working + -o ${REPORT_FILE} \ + ${SCAN_DIR} set +x shopt -u globstar -trufflehog3 --version > ${REPORT_DIR}/trufflehog_version.txt python ${SCRIPTS_DIR}/trufflehog-gate-check.py "${REPORT_FILE}"