From cfe5e9c92657bcbffc221be1ee5518f1ececa8b9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 12:10:05 -0700 Subject: [PATCH 01/16] adding app inspect and version bump all jobs --- .github/workflows/appinspect.yml | 41 ++++++++++++++++++++++++++++++ .github/workflows/build.yml | 2 +- .github/workflows/unit-testing.yml | 2 +- 3 files changed, 43 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/appinspect.yml diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml new file mode 100644 index 0000000000..a4902e745d --- /dev/null +++ b/.github/workflows/appinspect.yml @@ -0,0 +1,41 @@ +name: appinspect +on: + pull_request: + types: [opened, reopened, synchronize] + push: + branches: + - develop +jobs: + appinspect: + #Note that the CircleCI job used a Container. The way to do this with Github Actions + #is to first start up a Virtual Machine, then we can by following: + # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer + runs-on: ubuntu-latest + steps: + - name: Check out the repository code + uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy + architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified + + + - name: Install Python Dependencies and ContentCTL and Atomic Red Team + run: | + pip install contentctl==4.2.2 + git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git + + - name: Running build with enrichments + run: | + contentctl inspect --splunk-api-username $APPINSPECTUSERNAME --splunk-api-password $APPINSPECTPASSWORD --stack_type victoria --enrichments + mkdir -p artifacts/app_inspect_report + cp -r dist/*.{json,html} artifacts/app_inspect_report + cp -r dist/*.tar.gz artifacts/ + + - name: store_artifacts + uses: actions/upload-artifact@v4 + with: + name: content-latest + path: | + artifacts/DA-ESS-ContentUpdate-latest.tar.gz \ No newline at end of file diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 13e95e8001..e65c530755 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==4.2.0 + pip install contentctl==4.2.2 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - name: Running build with enrichments diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 4f51b0b1cb..464eabbb23 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -24,7 +24,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==4.2.0 + pip install contentctl==4.2.2 # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From 134689fb189572add98e07a7d00bf5ecb18ae6a5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 12:17:39 -0700 Subject: [PATCH 02/16] update secrets and codeowners --- .github/CODEOWNERS | 2 +- .github/dependabot.yml | 7 ------- .github/workflows/appinspect.yml | 5 +++-- 3 files changed, 4 insertions(+), 10 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 580d9f21c0..d258e9acdf 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1 +1 @@ -* @patel-bhavin @P4T12ICK \ No newline at end of file +* @patel-bhavin @P4T12ICK @ljstella @MHaggis @pyth0n1c \ No newline at end of file diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 627ed9d5e9..0000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,7 +0,0 @@ -version: 2 -updates: -- package-ecosystem: pip - directory: "/" - schedule: - interval: monthly - open-pull-requests-limit: 6 diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index a4902e745d..10932425aa 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -28,7 +28,7 @@ jobs: - name: Running build with enrichments run: | - contentctl inspect --splunk-api-username $APPINSPECTUSERNAME --splunk-api-password $APPINSPECTPASSWORD --stack_type victoria --enrichments + contentctl inspect --splunk-api-username ${{ secrets.APPINSPECTUSERNAME }} --splunk-api-password ${{ secrets.APPINSPECTPASSWORD }}--stack_type victoria --enrichments mkdir -p artifacts/app_inspect_report cp -r dist/*.{json,html} artifacts/app_inspect_report cp -r dist/*.tar.gz artifacts/ @@ -38,4 +38,5 @@ jobs: with: name: content-latest path: | - artifacts/DA-ESS-ContentUpdate-latest.tar.gz \ No newline at end of file + artifacts/DA-ESS-ContentUpdate-latest.tar.gz + artifacts/app_inspect_report \ No newline at end of file From a255f2d65b97bed43593bbb199560f698cb52297 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 12:39:34 -0700 Subject: [PATCH 03/16] add space --- .github/workflows/appinspect.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 10932425aa..541debe4fd 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -28,7 +28,7 @@ jobs: - name: Running build with enrichments run: | - contentctl inspect --splunk-api-username ${{ secrets.APPINSPECTUSERNAME }} --splunk-api-password ${{ secrets.APPINSPECTPASSWORD }}--stack_type victoria --enrichments + contentctl inspect --splunk-api-username ${{ secrets.APPINSPECTUSERNAME }} --splunk-api-password ${{ secrets.APPINSPECTPASSWORD }} --stack_type victoria --enrichments mkdir -p artifacts/app_inspect_report cp -r dist/*.{json,html} artifacts/app_inspect_report cp -r dist/*.tar.gz artifacts/ From e19a344be70c7deb6b1f52beb1f7061a631e8d08 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 12:57:21 -0700 Subject: [PATCH 04/16] udpating cp command --- .github/workflows/appinspect.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 541debe4fd..0a24639af5 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -29,8 +29,9 @@ jobs: - name: Running build with enrichments run: | contentctl inspect --splunk-api-username ${{ secrets.APPINSPECTUSERNAME }} --splunk-api-password ${{ secrets.APPINSPECTPASSWORD }} --stack_type victoria --enrichments + echo "done appinspect" mkdir -p artifacts/app_inspect_report - cp -r dist/*.{json,html} artifacts/app_inspect_report + cp -r dist/*.html artifacts/app_inspect_report cp -r dist/*.tar.gz artifacts/ - name: store_artifacts From 39459cafb5dc8f03d82f17318b14480576962a6b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 13:06:15 -0700 Subject: [PATCH 05/16] adding quotes --- .github/workflows/appinspect.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 0a24639af5..070e3c3559 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -27,8 +27,12 @@ jobs: git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - name: Running build with enrichments + env: + SPLUNK_API_USERNAME: "${{ secrets.SPLUNK_API_USERNAME }}" + SPLUNK_API_PASSWORD: "${{ secrets.SPLUNK_API_PASSWORD }}" run: | - contentctl inspect --splunk-api-username ${{ secrets.APPINSPECTUSERNAME }} --splunk-api-password ${{ secrets.APPINSPECTPASSWORD }} --stack_type victoria --enrichments + echo $SPLUNK_API_USERNAME + contentctl inspect --splunk-api-username "$SPLUNK_API_USERNAME" --splunk-api-password "$SPLUNK_API_PASSWORD" --stack_type victoria --enrichments echo "done appinspect" mkdir -p artifacts/app_inspect_report cp -r dist/*.html artifacts/app_inspect_report From 594e6e972c4bea9e5b6cfb9a6b085d87667c3bb0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 13:12:00 -0700 Subject: [PATCH 06/16] checking echo --- .github/workflows/appinspect.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 070e3c3559..3cd9abb8e6 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -28,11 +28,11 @@ jobs: - name: Running build with enrichments env: - SPLUNK_API_USERNAME: "${{ secrets.SPLUNK_API_USERNAME }}" - SPLUNK_API_PASSWORD: "${{ secrets.SPLUNK_API_PASSWORD }}" + APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}" + APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}" run: | - echo $SPLUNK_API_USERNAME - contentctl inspect --splunk-api-username "$SPLUNK_API_USERNAME" --splunk-api-password "$SPLUNK_API_PASSWORD" --stack_type victoria --enrichments + echo $APPINSPECTUSERNAME + contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments echo "done appinspect" mkdir -p artifacts/app_inspect_report cp -r dist/*.html artifacts/app_inspect_report From b3f18b068305dc544e235434fcb90d3dd142bc7c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 13:18:29 -0700 Subject: [PATCH 07/16] fail app inspect --- .../application/crushftp_server_side_template_injection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml index 6794bec15a..ef068fcd2e 100644 --- a/detections/application/crushftp_server_side_template_injection.yml +++ b/detections/application/crushftp_server_side_template_injection.yml @@ -7,7 +7,7 @@ data_source: - CrushFTP type: TTP status: production -description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. +description: password=password This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. search: '`crushftp` | rex field=_raw "\[(?HTTPS|HTTP):(?[^\:]+):(?[^\:]+):(?\d+\.\d+\.\d+\.\d+)\] (?READ|WROTE): \*(?[A-Z]+) (?[^\s]+) HTTP/[^\*]+\*" | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") From 06f4158b84677aeacf1662503575132bfd6f6832 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 14:02:38 -0700 Subject: [PATCH 08/16] try rm --- .../application/crushftp_server_side_template_injection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml index ef068fcd2e..8482be6685 100644 --- a/detections/application/crushftp_server_side_template_injection.yml +++ b/detections/application/crushftp_server_side_template_injection.yml @@ -7,7 +7,7 @@ data_source: - CrushFTP type: TTP status: production -description: password=password This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. +description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. rm -rf security/* The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. search: '`crushftp` | rex field=_raw "\[(?HTTPS|HTTP):(?[^\:]+):(?[^\:]+):(?\d+\.\d+\.\d+\.\d+)\] (?READ|WROTE): \*(?[A-Z]+) (?[^\s]+) HTTP/[^\*]+\*" | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") From 158d7061152e7e055fba8188d48c82e9efcab360 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 14:45:57 -0700 Subject: [PATCH 09/16] remove changes --- .../application/crushftp_server_side_template_injection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml index 8482be6685..6794bec15a 100644 --- a/detections/application/crushftp_server_side_template_injection.yml +++ b/detections/application/crushftp_server_side_template_injection.yml @@ -7,7 +7,7 @@ data_source: - CrushFTP type: TTP status: production -description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. rm -rf security/* The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. +description: This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis. search: '`crushftp` | rex field=_raw "\[(?HTTPS|HTTP):(?[^\:]+):(?[^\:]+):(?\d+\.\d+\.\d+\.\d+)\] (?READ|WROTE): \*(?[A-Z]+) (?[^\s]+) HTTP/[^\*]+\*" | eval message=if(match(_raw, "INCLUDE") and isnotnull(src_ip), "traces of exploitation by " . src_ip, "false") From 9b96a140ba169003630aa0b3e50c0ce7c80368ab Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 14:51:07 -0700 Subject: [PATCH 10/16] updating to use env --- .github/workflows/build.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e65c530755..f14cf8b3e3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,6 +11,8 @@ jobs: #is to first start up a Virtual Machine, then we can by following: # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest + env: + CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} # Use the environment variable steps: - name: Check out the repository code uses: actions/checkout@v4 @@ -23,7 +25,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==4.2.2 + echo "CONTENTCTL_VERSION is set to ${{ env.CONTENTCTL_VERSION }}" + pip install contentctl==${{ env.CONTENTCTL_VERSION }} git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - name: Running build with enrichments From aa85a2a3bdfc1f0f146955f479a261ec2333c7ac Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 14:54:00 -0700 Subject: [PATCH 11/16] updating env to prod --- .github/workflows/build.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f14cf8b3e3..a58df3b1c7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,6 +11,7 @@ jobs: #is to first start up a Virtual Machine, then we can by following: # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest + environment: production env: CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} # Use the environment variable steps: From 4379a2880f08dfc607d688bc3301a86582610037 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 14:57:09 -0700 Subject: [PATCH 12/16] add to all jobs --- .github/workflows/appinspect.yml | 6 +++++- .github/workflows/unit-testing.yml | 7 +++++-- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 3cd9abb8e6..44f13fd2e3 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -11,6 +11,9 @@ jobs: #is to first start up a Virtual Machine, then we can by following: # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest + environment: production + env: + CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} steps: - name: Check out the repository code uses: actions/checkout@v4 @@ -23,7 +26,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==4.2.2 + echo "CONTENTCTL_VERSION is set to ${{ env.CONTENTCTL_VERSION }}" + pip install contentctl==${{ env.CONTENTCTL_VERSION }} git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git - name: Running build with enrichments diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 464eabbb23..33f7891172 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -6,7 +6,9 @@ jobs: unit-testing: runs-on: ubuntu-latest if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job - # needs: [validate-tag-if-present, quit-for-dependabot] + environment: production + env: + CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} steps: #For fork PRs, always check out security_content and the PR target in security content! - name: Check out the repository code @@ -24,7 +26,8 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==4.2.2 + echo "CONTENTCTL_VERSION is set to ${{ env.CONTENTCTL_VERSION }}" + pip install contentctl==${{ env.CONTENTCTL_VERSION }} # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From fea71b01718dc8a2018854108c1b36d0fc0c71d4 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 15:17:23 -0700 Subject: [PATCH 13/16] remove enviroment and use repo variable --- .github/workflows/appinspect.yml | 1 - .github/workflows/build.yml | 1 - .github/workflows/unit-testing.yml | 1 - 3 files changed, 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 44f13fd2e3..ddce4f34b8 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -11,7 +11,6 @@ jobs: #is to first start up a Virtual Machine, then we can by following: # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest - environment: production env: CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} steps: diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a58df3b1c7..f14cf8b3e3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -11,7 +11,6 @@ jobs: #is to first start up a Virtual Machine, then we can by following: # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer runs-on: ubuntu-latest - environment: production env: CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} # Use the environment variable steps: diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 33f7891172..b87dc4a27d 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -6,7 +6,6 @@ jobs: unit-testing: runs-on: ubuntu-latest if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job - environment: production env: CONTENTCTL_VERSION: ${{ vars.CONTENTCTL_VERSION }} steps: From 3d11857b2297700994e5bb432bbe3a8c35c1c043 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 31 Jul 2024 18:30:00 -0700 Subject: [PATCH 14/16] adding dependabot for git actions --- .github/dependabot.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000000..0056901de6 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: +- package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" \ No newline at end of file From 53ee86a1482ffb4aa018b2d560c7458cd5e9116f Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 5 Aug 2024 12:23:12 -0700 Subject: [PATCH 15/16] updating to pr target --- .github/workflows/appinspect.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index ddce4f34b8..0aaa2b6bd0 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -1,8 +1,6 @@ name: appinspect on: - pull_request: - types: [opened, reopened, synchronize] - push: + pull_request_target: branches: - develop jobs: From 545a1cad1f31c5f0235a7cb429bea19be73fca1c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 5 Aug 2024 12:26:20 -0700 Subject: [PATCH 16/16] updating trigger condition --- .github/workflows/appinspect.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 0aaa2b6bd0..b71adb20c6 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -1,8 +1,7 @@ name: appinspect on: - pull_request_target: - branches: - - develop +- pull_request_target + jobs: appinspect: #Note that the CircleCI job used a Container. The way to do this with Github Actions